Splunk Search

How to do stats count based on condition?

csahoo
Explorer
index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| stats count(eval(status="Received")) as received count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event



where as the
source : - is my application name
event :- Type of request whether synchronous request or Asynchronous request
labeltype : - Different type of label
sourcenodecode and geocode :- is the shopcode and shopregion from where the label is requested
received - no of label request received
failed - no of label request failed


Now i want to find the received and failed request count based on sourceNodeCode, geoCode, LabelType, event

But for failed request count i want to add condition -

in case of synchronous request or event the failed count should fetch from '*gps-request-processor-test*' application

in case of asynchronous request or event the failed count should fetch from "*gps-external-processor-test*" OR "*gps-artifact-processor-test*" application

The output should look something similar to this attached o/p.

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

So this is to add one more condition to the selection command I described in Re: Count based on condition. (If that original problem is solved, please mark an answer as solution.) All you need to do is to exclude Failed from the restrictive condition, i.e.,

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*"
 OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| where status!="Failed" OR (event == "Sync" AND source like "%gps-request-processor%" OR event == "Async")
 AND (source like "%gps-external-processor%" OR source like "%gps-artifact-processor%")
| stats count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| eval  failedevent=if(status="Failed" AND ((event="Sync" AND sourceNodeCode="gps-request-processor-test") OR (event="Async" AND (sourceNodeCode="gps-external-processor-test" OR sourceNodeCode="gps-artifact-processor-test"))), 1, 0)
| stats count(eval(status="Received")) as received sum(failedevent) as failed by sourceNodeCode geoCode LabelType event
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...