Splunk Search

Is it possible to use if else condition based on the search to create stats?

nukarajusundeep
New Member
index=concourse
sourcetype="deployments: csv"
if project = * and team=$team$ | stats count by project, team
elif team=* and project=$project$ | stats count by team, project

Can we do something like this in Splunk search?

0 Karma

anthonymelita
Contributor

I'm not sure if it will get you what you need, but you can wrap an eval inside of a stats function.
count(eval(team=$team$ AND project=*))

0 Karma

dmarling
Builder

Where is the data that is going to populate the two tokens you have in your search coming from? Is that streaming from the search that returns with your index=concourse sourcetype="deployments: csv" part of the query? Also what is your ultimate goal, Are you trying to say, if project is not null and team equals token team stats count by project, team, else if team is not null and project equals token project stats count by team project? Are you doing this because the project/team field is sometimes null? Can you mock up the output you are looking for?

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

nukarajusundeep
New Member

I am trying to create a dashboard with deployments during the month based on projects as dropdown fields using Column graph

this is my query for the dashboard.

index="concourse" sourcetype="deployments: csv" month="$mt$" project="$project$" | stats count by project, month

This basically gives me the count for the deployments by project

with the above query if i choose
Project = ALL and Month=February

This is basically showing the data correctly in the graph wit proper name [like a, b, c projects deployed during this month]

When I choose Project=BUY and Month=ALL
Then it is populating the results but showing as [BUY,BUY,BUY,BUY] on x-axis and count on y-axis and not displaying the month

0 Karma

dmarling
Builder

Gotcha. You may want to consider using chart instead of stats for this use case:

index="concourse" sourcetype="deployments: csv" month="$mt$" project="$project$"
| chart count over month by project

This will make it so month is always the x-axis and your columns will be different projects.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...