Splunk Search

How to get distinct count for which if condition satisfies?

arugupta
New Member

My Aim :
This below query gives me count of success, failure by b_key, c_key. I want to get the distinct count of b_key for which the failure occurred. In the example below it will be 2.

arugupta_0-1675258560121.png

 

 

 

| eval Complete = case(key_a="complete", "Complete")
| eval Init = case(key_a="init" , "Init")
| stats count(Init) as Init, count(Complete) as Complete by b_key, c_key
| eval Fcount = if((Init != Complete),1,0) 
| eval Scount = if((Init = Complete),1,0) 
| stats sum(Fcount) as FailureCount, sum(Scount) as SuccessCount 
| eval total=(FailureCount+SuccessCount) 
| eval Success% = round(SuccessCount/total*100,2)
| eval Failure% = round(FailureCount/total*100,2) 
| table FailureCount, SuccessCount, Success%, Failure%

 

 

Labels (1)
0 Karma

arugupta
New Member

@ITWhisperer It did not solve the purpose. Can you explain in brief what is it doing? What is 'eval key='Non-zero count' referring to?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This just sets a "label" for the row with the totals in

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe
    [| stats count(eval(SuccessCount>0)) as SuccessCount count(eval(FailureCount>0)) as FailureCount
    | eval key="Non-zero counts"]
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...