Splunk Search

How to get eventstats count with dynamic parameter?

Kislac
Engager

Hello!

I would like to count from a field based on another field.
I have a events with following  2 fields (Doors_Order & RQM_Order). I would like to count based on Doors_Order field from entire RQM_Order fields.

In excel this look like this:

=COUNTIF(E:E;C9)

Kislac_2-1651585099290.png

 

I have tried with this:
| basesearch
| eventstats count(eval(RQMOrder_NotValidated=RQMOrder)) as ReqGap2

But this will count only if the 2 field is same in 1 event, not in entire events lists. I have tired lots of another things, but non of them worked. In excel this looks easy. Is there any solution in splunk?

 

 

Labels (1)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

@Kislac - Can you try something like this?

 

<your-search>
| join type=left DoorsOrder [| search <your search> | stats count by RQMOrder | rename RQMOrder AS DoorsOrder]
| fillnull count value=0
| rename count as ReqGap2

(I'm using field names as shown in the excel screenshots if some fields need to change please do so.)

 

 

I hope this helps!!!

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Kislac - Can you try something like this?

 

<your-search>
| join type=left DoorsOrder [| search <your search> | stats count by RQMOrder | rename RQMOrder AS DoorsOrder]
| fillnull count value=0
| rename count as ReqGap2

(I'm using field names as shown in the excel screenshots if some fields need to change please do so.)

 

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...