Splunk Search

How to count mixed NULL/NOT NULL result sets

Path Finder

Let's say I got a table as search result like this:

Object Name                               | Field_A                                 | Field_B
_____________________________________________________________________________________________________________
object_a                                  | value_AA                                | value_AA
object_b                                  |                                         | value_BB
object_c                                  | value_A                                 |
object_d                                  | value_DD                                | value_XX
object_e                                  |                                         |
object_f                                  | value_FF                                | value_FF
object_g                                  | value_GG                                |
object_h                                  | value_AA                                | value_AA

So I got different objects, with maybe different maybe not different values. The information I want:
1. How many objects do have a Value in Field A AND Field B while Field A AND Field B do have the same value
2. How many objects do have a Value in Field A AND Field B while Field A AND Field B do NOT have the same value
3. How many objects do have a value in Field_A but not in Field_B
4. How many objects do have a value in Field_B but not in Field_A
5. How many objects have both, Field_A and Field_B empty

So my desired result would look something like this:

Both and equal (1)    | Both but Different (2) | Only F_A (3) | Only F_B(4) | Both empty (5)
_____________________________________________________________________________________________________________
3                     | 1                      | 2            | 1           | 1
0 Karma
1 Solution

Revered Legend

Try something like this

your base search | eval Type=case(isnotnull(Field_A) AND isnotnull(Field_B) AND Field_A=Field_B,"Both and equal", isnotnull(Field_A) AND isnotnull(Field_B) AND Field_A!=Field_B,"Both but different",isnotnull(Field_A) AND isnull(Field_B)," Only F_A", isnull(Field_A) AND isnotnull(Field_B),"Only F_B",1=1,"Both empty") | eval temp=1 | chart count over temp by Type | fields - temp

Just added field temp for chart command to produce columns for each value of field Type.

View solution in original post

Revered Legend

Try something like this

your base search | eval Type=case(isnotnull(Field_A) AND isnotnull(Field_B) AND Field_A=Field_B,"Both and equal", isnotnull(Field_A) AND isnotnull(Field_B) AND Field_A!=Field_B,"Both but different",isnotnull(Field_A) AND isnull(Field_B)," Only F_A", isnull(Field_A) AND isnotnull(Field_B),"Only F_B",1=1,"Both empty") | eval temp=1 | chart count over temp by Type | fields - temp

Just added field temp for chart command to produce columns for each value of field Type.

View solution in original post

Path Finder

sorry 4 my late answer - that worked out of the box. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!