Splunk Search

How to search multiple counts based on fields condition using single stat

Explorer

There are multiple fields like
time number description severity status restoreduration
I want to take total count , count when status has true value , values of restore
duration when severity is 1.
I am trying with stats command like below, but for 3rd requirement its not working

| stats count as totalcount count(eval(status="true")) as statuscount values(eval(if(severity="1",restore_duration,null))) as duration

Please suggest, how to achieve when severity=1, then get the values of restoreduration using same stats.
After taking values from restore
duration , i have to calculate average of duration also.

Tags (2)
1 Solution

Communicator

Hi,
Instead putting the if condition in stats , have the eval if condition before stats sepatly and try

|eval duration=if((severity="1"),restoreduration,null)
| stats count as total
count, count(eval(status="true")) as status_count

View solution in original post

0 Karma

Communicator

Hi @avni26

This rightly does not work and here's why.

The first two commands albeit looking through multiple field values returns one single aggregated value whereas the values is expected to return one single multi value field of restore_duration values for Sev1 scenarios.

The below run anywhere example should work for you by virtue of creating the additional duration field. You should be able to customize it to work for your example. If you need to create a multivalue field(which is a complication), use streamstats to create a field based on severity ahead of your stats

| makeresults count=10 
| streamstats count
| eval status=if(count%2>0,"true","false") , severity=if(count%2>0,2,1),restore_duration=if(count%2>0,25,30), duration=if(severity=1,restore_duration,null())
| stats count as total_count count(eval(status="true")) as status_count avg(duration) as duration
0 Karma

Communicator

Hi,
Instead putting the if condition in stats , have the eval if condition before stats sepatly and try

|eval duration=if((severity="1"),restoreduration,null)
| stats count as total
count, count(eval(status="true")) as status_count

View solution in original post

0 Karma

Explorer

@Anantha123 Thank you. It perfectly worked for me

0 Karma