Splunk Search

How to calculate distinct count with condition?

LearningGuy
Motivator

Hello,

How to calculate distinct count with condition?

How to calculate unique vuln that has score >0, group by ip?


Before calculation

ipvulnscore
1.1.1.1vuln10
1.1.1.1vuln10
1.1.1.1vuln23
1.1.1.1vuln23
1.1.1.1vuln23
1.1.1.1vuln37
1.1.1.1vuln37
2.2.2.2vuln10
2.2.2.2vuln40
2.2.2.2vuln55
2.2.2.2vuln55


After calculation

ipdc(vuln)dc(vuln) score > 0
1.1.1.132
2.2.2.231



Thank you so much

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip

View solution in original post

LearningGuy
Motivator

Wow, it worked..    I will accept this as solution.   Thank you so much
What did the "eval if" part do?
if score > 0, then include the vuln, if not assign null function, which means DC will ignore it?

eval(if(score > 0,vuln,null()))

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct, null values (as returned by the null() function) are ignored by the dc() function

LearningGuy
Motivator

Hello @ITWhisperer 
How do I calculate sum of unique vuln that has score >0?   
in my mind, it's like this: sum (dc(vuln) score > 0)    but when i tried it, it didn't work

ipdc(vuln)dc(vuln) score > 0sum (dc(vuln) score > 0)
1.1.1.13210
2.2.2.2315


Thank you so much

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(score) as score by ip vuln
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all sum(score) as total_score by ip

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...