Splunk Search

How to achieve sum of two fields excluding null fields?

monicateja
Explorer

Hi,

can any one help me how to get splunk query for below requirement.

index="abc"
| search "message"="Exit" | search "stepName"=NotifyFlowEnd | search stepName!=""
| search "message"="PAST_TIME_FRAME"
|  chart count by "message"

In message="Exit"  these 2 conditions need to include ----->     | search "stepName"=NotifyFlowEnd | search stepName!=""

 

Output is to get Sum of  "message"="Exit"  +  "PAST_TIME_FRAME" count

Labels (3)
0 Karma

monicateja
Explorer

Thanks for response. Query is working but only getting count values for message=Exit but not for PAST_TIME_FRAME

step.name= NotifyFlowEnd is extra filter for message=Exit and need to remove step.name=“”

0 Karma

yuanliu
SplunkTrust
SplunkTrust

In that case,

index="abc" (("message"="Exit" "stepName"=NotifyFlowEnd) OR (message="PAST_TIME_FRAME" stepName!=""))
| chart count by "message"

It is much better to explain the problem and data in text even when you illustrate code that you tried.  Also, if the code you tried did not get the desired result, describe the result and explain why it is not desired.  This way, others do not have to guess what you meant in code fragments that do not reflect the actual requirements.

0 Karma

yuanliu
SplunkTrust
SplunkTrust
index="abc" "message" IN ("Exit", "PAST_TIME_FRAME") "stepName"=NotifyFlowEnd
| chart count by "message"

This should do.  Note that search commands should be combined in the first command as much as possible.  Another thing to note is that if you have stepName=NotifyFlowEnd, stepName !="" would be unnecessary.

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...