Splunk Search

How to calculate distinct count with condition?

LearningGuy
Motivator

Hello,

How to calculate distinct count with condition?

How to calculate unique vuln that has score >0, group by ip?


Before calculation

ipvulnscore
1.1.1.1vuln10
1.1.1.1vuln10
1.1.1.1vuln23
1.1.1.1vuln23
1.1.1.1vuln23
1.1.1.1vuln37
1.1.1.1vuln37
2.2.2.2vuln10
2.2.2.2vuln40
2.2.2.2vuln55
2.2.2.2vuln55


After calculation

ipdc(vuln)dc(vuln) score > 0
1.1.1.132
2.2.2.231



Thank you so much

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip

View solution in original post

LearningGuy
Motivator

Wow, it worked..    I will accept this as solution.   Thank you so much
What did the "eval if" part do?
if score > 0, then include the vuln, if not assign null function, which means DC will ignore it?

eval(if(score > 0,vuln,null()))

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct, null values (as returned by the null() function) are ignored by the dc() function

LearningGuy
Motivator

Hello @ITWhisperer 
How do I calculate sum of unique vuln that has score >0?   
in my mind, it's like this: sum (dc(vuln) score > 0)    but when i tried it, it didn't work

ipdc(vuln)dc(vuln) score > 0sum (dc(vuln) score > 0)
1.1.1.13210
2.2.2.2315


Thank you so much

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(score) as score by ip vuln
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all sum(score) as total_score by ip

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...