Splunk Search

How to calculate distinct count with condition?

LearningGuy
Motivator

Hello,

How to calculate distinct count with condition?

How to calculate unique vuln that has score >0, group by ip?


Before calculation

ipvulnscore
1.1.1.1vuln10
1.1.1.1vuln10
1.1.1.1vuln23
1.1.1.1vuln23
1.1.1.1vuln23
1.1.1.1vuln37
1.1.1.1vuln37
2.2.2.2vuln10
2.2.2.2vuln40
2.2.2.2vuln55
2.2.2.2vuln55


After calculation

ipdc(vuln)dc(vuln) score > 0
1.1.1.132
2.2.2.231



Thank you so much

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip

View solution in original post

LearningGuy
Motivator

Wow, it worked..    I will accept this as solution.   Thank you so much
What did the "eval if" part do?
if score > 0, then include the vuln, if not assign null function, which means DC will ignore it?

eval(if(score > 0,vuln,null()))

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct, null values (as returned by the null() function) are ignored by the dc() function

LearningGuy
Motivator

Hello @ITWhisperer 
How do I calculate sum of unique vuln that has score >0?   
in my mind, it's like this: sum (dc(vuln) score > 0)    but when i tried it, it didn't work

ipdc(vuln)dc(vuln) score > 0sum (dc(vuln) score > 0)
1.1.1.13210
2.2.2.2315


Thank you so much

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(score) as score by ip vuln
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all sum(score) as total_score by ip

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...