Splunk Search

## How to calculate distinct count with condition?

Builder

Hello,

How to calculate distinct count with condition?

How to calculate unique vuln that has score >0, group by ip?

Before calculation

 ip vuln score 1.1.1.1 vuln1 0 1.1.1.1 vuln1 0 1.1.1.1 vuln2 3 1.1.1.1 vuln2 3 1.1.1.1 vuln2 3 1.1.1.1 vuln3 7 1.1.1.1 vuln3 7 2.2.2.2 vuln1 0 2.2.2.2 vuln4 0 2.2.2.2 vuln5 5 2.2.2.2 vuln5 5

After calculation

 ip dc(vuln) dc(vuln) score > 0 1.1.1.1 3 2 2.2.2.2 3 1

Thank you so much

Labels (1)
• ### stats

1 Solution
SplunkTrust
``| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip``
Builder

Wow, it worked..    I will accept this as solution.   Thank you so much
What did the "eval if" part do?
if score > 0, then include the vuln, if not assign null function, which means DC will ignore it?

`eval(if(score > 0,vuln,null()))`

SplunkTrust

Correct, null values (as returned by the null() function) are ignored by the dc() function

Builder

Hello @ITWhisperer
How do I calculate sum of unique vuln that has score >0?
in my mind, it's like this: sum (dc(vuln) score > 0)    but when i tried it, it didn't work

 ip dc(vuln) dc(vuln) score > 0 sum (dc(vuln) score > 0) 1.1.1.1 3 2 10 2.2.2.2 3 1 5

Thank you so much

SplunkTrust
``````| stats values(score) as score by ip vuln
| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all sum(score) as total_score by ip``````
SplunkTrust
``| stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all by ip``
Get Updates on the Splunk Community!

#### Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

#### Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

#### Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...