Splunk Search

help on tostring function

jip31
Motivator

hello

I am doing the distinct count below in my search

| stats dc(host) AS OnlineCount by Code 
| where Code = "Online"
| fields OnlineCount 
| appendpipe 
    [ stats count 
    | where count=0]

But I also need to add text after the distinct count
So I am doing this after the distinct count but I have nothing

| eval dc = if(dc== 0, "no host", tostring(dc) + " hosts")

could you help me please??

Tags (1)
0 Karma
1 Solution

koshyk
Super Champion

I think you need to put name as "dc" , instead of variable OnlineCount
Also your code contains a NULL problem for "dc", so i've changed the last field to put value only if the dc >0

So

|makeresults
| eval hosts="myhost"
| eval Code="Online"
| fields hosts,Code
| stats dc(hosts) AS dc by Code 
 | where Code = "Online"
 | fields dc 
 | appendpipe 
     [ stats count 
     | where count=0]
 | eval dc = if(dc> 0, tostring(dc) + " hosts","no host")

View solution in original post

0 Karma

koshyk
Super Champion

I think you need to put name as "dc" , instead of variable OnlineCount
Also your code contains a NULL problem for "dc", so i've changed the last field to put value only if the dc >0

So

|makeresults
| eval hosts="myhost"
| eval Code="Online"
| fields hosts,Code
| stats dc(hosts) AS dc by Code 
 | where Code = "Online"
 | fields dc 
 | appendpipe 
     [ stats count 
     | where count=0]
 | eval dc = if(dc> 0, tostring(dc) + " hosts","no host")
0 Karma

jip31
Motivator

Also thanks to you but I can accept only one answer...

0 Karma

Sukisen1981
Champion

There is no field named dc which you are executing your eval on, try this:
| stats dc(host) AS OnlineCount by info| eval OnlineCount = if(OnlineCount == 0, "no host", tostring(OnlineCount) + " hosts")
| fields OnlineCount

0 Karma

jip31
Motivator

thanks a lot

0 Karma

jip31
Motivator

ok thanks!
I forgotten "as onlinecount"......

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...