Splunk Search

## Problem with the summation in chart command in SPLUNK

Contributor

Hi,

I want to find out how what is the total number of "Exit" and "Entry" for the particular CARDNUMBER for a particular TRANSITDATE, for that to do I gave the below query, but it is not returning my any answer,

Please let me know where I am doing wrong with the query or any other alternative is there :

chart count((eval(STRDIRECTION="Entry"))+(eval(STRDIRECTION="Exit"))) as "TotalCount" over "TRANSITDATE" by "CARD_NUMBER"

Tags (2)
Influencer

This :

``````((eval(STR_DIRECTION="Entry"))+(eval(STR_DIRECTION="Exit"))
``````

assuming that only 1 statement can be true, will never return anything.

It evaluates to NULL + 1 or 1 + NULL, which is always null

i.e.

``````* | head 1 | eval a=NULL | eval b=1 | eval c=a+b | table a b c
``````

So you need an if statement to return sane values:

``````( (eval(if(STR_DIRECTION=="Entry",1,0))) + (eval(if(STR_DIRECTION=="Exit",1,0))) )
``````

There's probably a far easier way to do this if you post some sample data though

Update

``````... | stats count(eval(STR_DIRECTION=="Exit")) as Exit count(eval(STR_DIRECTION=="Entry")) as Entry by TRANSIT_DATE CARD_NUMBER
| eval Complete=if(Exit==Entry,"Complete","Incomplete")
``````
Influencer

Contributor

I have given this code , but it gives me some different answer, I want to compare the number of exit with the number or entry for a particular Card_num for a particular day

|inputlookup "Data-Sample.csv" | table "TRANSITDATE","NAME","SURNAME","IDENTIFIER","CARDNUMBER","STRDIRECTION","STRTRANSITSTATUS","TERMINAL" | chart limit=29 count(eval(STRDIRECTION="Entry" OR STRDIRECTION="Exit")) as "TotalCount" over "TRANSITDATE" by "CARDNUMBER" |eval a=strptime(TRANSIT_DATE,"%d/%m/%Y") | sort a | fields - a

Contributor

I have a report which contains few columns as "Date", "Card_num","Status"

I have the "Date" in %d/%m/%Y format
"Card_num" is a numeric field ( Unique value )
"Status" Contains two values,either "Entry" or "Exit"

Now, I would like to know for a particular "Card_num" for a particular "Date" , total number of "Exit" is equal to the total number of "Entry" or not, if it is equal I should make an another column as "Result" and value should be "Complete Transaction" and for unequal number It "Result" should contain "Incomplete Transaction"  