Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- count condition
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm having trouble writing a search statement that sets the count to 0 when the service is normally.
This is my data example.
name status
A failed
B failed
C failed
A normally
B normally
C normally
Counting with name will also count normally.
I want to count status failed only.
In this case, everything is normally, I want to display 0.
I know this is not correct, but I want to do like this.
|eval A =if((status=failed),count,null)
|stats count as A
I can't think of a conditional statement that counts when the status is failed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this ?
<your search> | stats count(eval(status="failed")) as failed_count by name
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this ?
<your search> | stats count(eval(status="failed")) as failed_count by name
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
instead of if , use a case
|eval A=case(status=failed,1)
so A has counts only for failed status
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for helping.
what do it mean (status=failed,1)?
I thought (status=failed,0).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi you said 'I want to count status failed only.' hence I made status=failed as 0.
You can assign any value based on your need
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
