How to search multiple counts based on fields condition using single stat

[avni26]

There are multiple fields like
time number description severity status restore_duration
I want to take total count , count when status has true value , values of restore_duration when severity is 1.
I am trying with stats command like below, but for 3rd requirement its not working

| stats count as total_count count(eval(status="true")) as status_count values(eval(if(severity="1",restore_duration,null))) as duration

Please suggest, how to achieve when severity=1, then get the values of restore_duration using same stats.
After taking values from restore_duration , i have to calculate average of duration also.

[vik_splunk]

Hi @avni26

This rightly does not work and here's why.

The first two commands albeit looking through multiple field values returns one single aggregated value whereas the values is expected to return one single multi value field of restore_duration values for Sev1 scenarios.

The below run anywhere example should work for you by virtue of creating the additional duration field. You should be able to customize it to work for your example. If you need to create a multivalue field(which is a complication), use streamstats to create a field based on severity ahead of your stats

| makeresults count=10 
| streamstats count
| eval status=if(count%2>0,"true","false") , severity=if(count%2>0,2,1),restore_duration=if(count%2>0,25,30), duration=if(severity=1,restore_duration,null())
| stats count as total_count count(eval(status="true")) as status_count avg(duration) as duration

[Anantha123 · Accepted solution]

Hi,
Instead putting the if condition in stats , have the eval if condition before stats sepatly and try

|eval duration=if((severity="1"),restore_duration,null)
| stats count as total_count, count(eval(status="true")) as status_count

[avni26]

@Anantha123 Thank you. It perfectly worked for me