Splunk Search
Highlighted

Return value based on missing field

Path Finder

I want to make a search that will return a count of sessionid based on the following fields
logged
out, loggedin
I want a count of how many sessions have an event with the logged
in field existing & the logged_out field not existing, this way I can tell exactly how many sessions are currently online.

How would I compare based on a field not existing, I tried isnull() and it didn't work as needed.

0 Karma
Highlighted

Re: Return value based on missing field

Path Finder

Something like if loggedin="yes" & nonexist(loggedout) return true
count true by session_id

0 Karma
Highlighted

Re: Return value based on missing field

SplunkTrust
SplunkTrust

@ialahdal

Try:

YOUR_SEARCH | eval flag=if(logged_in=="Yes" AND isnull(logged_out),1,0)
| stats sum(flag)

Sample:

| makeresults 
| eval logged_in="Yes",logged_out="Yes" 
| append 
    [| makeresults 
    | eval logged_in="Yes"] 
| eval flag=if(logged_in=="Yes" AND isnull(logged_out),1,0)
| stats sum(flag)
0 Karma
Highlighted

Re: Return value based on missing field

Influencer

@ialahdal You can do something like below.

<your search query> | stats count(eval(ISNOTNULL(logged_in))) as in_count , count(eval(ISNOTNULL(logged_out)) as out_count by SessionID| where in_count  > out_count

View solution in original post

0 Karma
Highlighted

Re: Return value based on missing field

Path Finder

Thanks to you and @kamlesh_vaghela, I think isnull is making values null, using isnotnull like you mentioned did get me to the results I needed eventually.
Thanks.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.