Splunk Search

How to do stats count based on condition?

csahoo
Explorer
index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| stats count(eval(status="Received")) as received count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event



where as the
source : - is my application name
event :- Type of request whether synchronous request or Asynchronous request
labeltype : - Different type of label
sourcenodecode and geocode :- is the shopcode and shopregion from where the label is requested
received - no of label request received
failed - no of label request failed


Now i want to find the received and failed request count based on sourceNodeCode, geoCode, LabelType, event

But for failed request count i want to add condition -

in case of synchronous request or event the failed count should fetch from '*gps-request-processor-test*' application

in case of asynchronous request or event the failed count should fetch from "*gps-external-processor-test*" OR "*gps-artifact-processor-test*" application

The output should look something similar to this attached o/p.

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

So this is to add one more condition to the selection command I described in Re: Count based on condition. (If that original problem is solved, please mark an answer as solution.) All you need to do is to exclude Failed from the restrictive condition, i.e.,

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*"
 OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| where status!="Failed" OR (event == "Sync" AND source like "%gps-request-processor%" OR event == "Async")
 AND (source like "%gps-external-processor%" OR source like "%gps-artifact-processor%")
| stats count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| eval  failedevent=if(status="Failed" AND ((event="Sync" AND sourceNodeCode="gps-request-processor-test") OR (event="Async" AND (sourceNodeCode="gps-external-processor-test" OR sourceNodeCode="gps-artifact-processor-test"))), 1, 0)
| stats count(eval(status="Received")) as received sum(failedevent) as failed by sourceNodeCode geoCode LabelType event
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...