Splunk Search
Highlighted

How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Explorer

I'm trying to count the number of occurrences of a field WITH values and the number of the same field WITHOUT values in the same search. I can't seem to return any counts for either eval statement. I am using HUNK.

base search | eval zip=(if(NOT LOCATION.postalCode="*",1,0)) | stats sum(zip) as count | eval noZip=(if(LOCATION.postalCode="*",1,0)) | stats sum(noZip)
0 Karma
Highlighted

Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Explorer

not sure why but it's not displaying correctly but in my query I do have an * between the quotes in both statements

0 Karma
Highlighted

Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Influencer

Answers uses markdown for formatting, so without indenting 4 spaces it was intrepreting the * as markers for italics. but if you indent 4 spaces, it becomes a code block... https://daringfireball.net/projects/markdown/syntax

Highlighted

Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Influencer

I don't have experience with Hunk, but using just core Splunk would something like this work?

base search | stats count(LOCATION.postalCode) as countWith count(eval(isnull(LOCATION.postalCode))) as countWithout 

Alternatively if you need to use your evals and sums, if you move both evals to before the stats you could do both sums in one stats

base search | eval zip=... | eval noZip=... | stats sum(zip) as count sum(noZip)
0 Karma
Highlighted

Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Explorer

This is close..except the
count(eval(isnull(LOCATION.postalCode)))

statement still brings in records with the LOCATION.postalCode field. How can I incorporate a WHERE isnull(LOCATION.postalCode) into the eval?

0 Karma
Highlighted

Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Legend

Couple of options you could try

base search | eval zip=if(LOCATION.postalCode="*", 1, 0) | stats count(eval(zip=1)) as wzip count(eval(zip=0)) as nozip 

OR

base search | stats count(eval(LOCATION.postalCode="*") as zip count as total | eval nozip=total-zip
0 Karma
Highlighted

Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Esteemed Legend

Try this:

base search | stats count AS total, count(eval(isnull(LOCATION.postalCode))) AS noZip | eval Zip = count - noZip
0 Karma