Splunk Search

Query to display count boolean fields as seperate columns

dreamygguy
New Member

Hello,
I'm trying to create a splunk query that will enable me to display the count of the TRUE and FALSE values of an operation. Can anybody help with this?

The output I'm expecting to display is something like the following.

Time  Operation   Success=True  Success=False 
10AM  ABC         20            0
11AM  ABC         30            5
12AM  ABC         30            0

Thank You!

Tags (3)
0 Karma
1 Solution

kml_uvce
Builder
your query|chart count(eval(<field>=TRUE)) AS Success=True,  count(eval(<field>=FALSE)) AS Success=False by Time Operation
kamal singh bisht

View solution in original post

kml_uvce
Builder
your query|chart count(eval(<field>=TRUE)) AS Success=True,  count(eval(<field>=FALSE)) AS Success=False by Time Operation
kamal singh bisht

proletariat99
Communicator

This syntax doesn't work for me. Is there something missing? I'm v6.2.

index= |chart count(eval(="TRUE")) AS Success=True, count(eval(="FALSE")) AS Success=False by hostname

Error in 'chart' command: The specifier 'AS' is invalid. It must be in form (). For example: max(size).

The search job has failed due to an error. You may be able view the job in the Job Inspector.

0 Karma

kml_uvce
Builder

this was the typo error from me

kamal singh bisht
0 Karma

dreamygguy
New Member

Thank you for your answer! The only change I made is for the following commands -

count(eval(=TRUE)), count(eval(=FALSE))

the value should be inside quotes.

count(eval(="TRUE")) , count(eval(="FALSE"))

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...