Splunk Search

How to count the values of a field and add it to existing chart?

2chs
Explorer

Hi There, 

we have a search which covers multiple values as below (each field has a single value)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime

I wanted to add two extra results to the same search, but this time the field has two values

for example: if we want count of a field "Processed", it has two cases

case1: Processed=true

case1: Processed=false

How to count these by true or false and show in the same table as above?

Please help.

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval processedTrue=if(Processed,true,null())
| eval processedFalse=if(Processed,null(),true)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime
count(processedTrue) as ProcessedOK
count(processedFalse) as NotProcessed

View solution in original post

2chs
Explorer

Thanks @ITWhisperer but not sure if am missing something, I get the below error:

Error in 'eval' command: The arguments to the 'if' function are invalid.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I assumed the field Processed was already boolean. Try:

| eval processedTrue=if(Processed=true,true,null())
| eval processedFalse=if(Processed=true,null(),true)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime
count(processedTrue) as ProcessedOK
count(processedFalse) as NotProcessed

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval processedTrue=if(Processed,true,null())
| eval processedFalse=if(Processed,null(),true)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime
count(processedTrue) as ProcessedOK
count(processedFalse) as NotProcessed
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...