Splunk Search

conditional distinct count

zahmadian
Engager

Hello,

Is there a way I can merge these two searches into a single conditional search?

index="webs" (process_resource>0) AND (subs_id>0)| bucket _time span=1h |stats distinct_count(process_id) as NumProcesses by _time

index="webs" (process_resource==0) AND (subs_id>0)| bucket _time span=1h |stats distinct_count(process_id) as NumProcesses0 by _time

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I suspect you want something like this. It uses an eval command to make a new field on each event called "type". For each event the value will be either "zero" or "greater than zero", depending. Then we simply use timechart to render the chart you already had, except we split it by our new type field.

index="webs" (process_resource>=0) AND (subs_id>0) 
| eval type=if(process_resource==0,"zero","greater_than_zero") 
| timechart span=1h distinct_count(process_id) by type

View solution in original post

sideview
SplunkTrust
SplunkTrust

I suspect you want something like this. It uses an eval command to make a new field on each event called "type". For each event the value will be either "zero" or "greater than zero", depending. Then we simply use timechart to render the chart you already had, except we split it by our new type field.

index="webs" (process_resource>=0) AND (subs_id>0) 
| eval type=if(process_resource==0,"zero","greater_than_zero") 
| timechart span=1h distinct_count(process_id) by type

Runals
Motivator

index = webs process_resource>=0 subs_id>0 | bucket span=1h _time | stats dc(eval(process_resource>0)) as NumProcesses dc(eval(process_reaource=0)) as NumProcesses0 by _time

0 Karma

stephanefotso
Motivator

Here you go with appendcols!

index="webs" (process_resource>0) subs_id>0| bucket _time span=1h |stats distinct_count(process_id) as NumProcesses by _time|appendcols [search index="webs" (process_resource>0) subs_id>0| bucket _time span=1h |stats distinct_count(process_id) as NumProcesses0 by _time]|table _time NumProcesses NumProcesses0

SGF
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...