Splunk Search

help on tostring function

jip31
Motivator

hello

I am doing the distinct count below in my search

| stats dc(host) AS OnlineCount by Code 
| where Code = "Online"
| fields OnlineCount 
| appendpipe 
    [ stats count 
    | where count=0]

But I also need to add text after the distinct count
So I am doing this after the distinct count but I have nothing

| eval dc = if(dc== 0, "no host", tostring(dc) + " hosts")

could you help me please??

Tags (1)
0 Karma
1 Solution

koshyk
Super Champion

I think you need to put name as "dc" , instead of variable OnlineCount
Also your code contains a NULL problem for "dc", so i've changed the last field to put value only if the dc >0

So

|makeresults
| eval hosts="myhost"
| eval Code="Online"
| fields hosts,Code
| stats dc(hosts) AS dc by Code 
 | where Code = "Online"
 | fields dc 
 | appendpipe 
     [ stats count 
     | where count=0]
 | eval dc = if(dc> 0, tostring(dc) + " hosts","no host")

View solution in original post

0 Karma

koshyk
Super Champion

I think you need to put name as "dc" , instead of variable OnlineCount
Also your code contains a NULL problem for "dc", so i've changed the last field to put value only if the dc >0

So

|makeresults
| eval hosts="myhost"
| eval Code="Online"
| fields hosts,Code
| stats dc(hosts) AS dc by Code 
 | where Code = "Online"
 | fields dc 
 | appendpipe 
     [ stats count 
     | where count=0]
 | eval dc = if(dc> 0, tostring(dc) + " hosts","no host")
0 Karma

jip31
Motivator

Also thanks to you but I can accept only one answer...

0 Karma

Sukisen1981
Champion

There is no field named dc which you are executing your eval on, try this:
| stats dc(host) AS OnlineCount by info| eval OnlineCount = if(OnlineCount == 0, "no host", tostring(OnlineCount) + " hosts")
| fields OnlineCount

0 Karma

jip31
Motivator

thanks a lot

0 Karma

jip31
Motivator

ok thanks!
I forgotten "as onlinecount"......

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...