how to count rows with lack of field !

[ashishv]

so i have a log which has column/field which will be populated with "Y" if there is an ERROR, feild name is ERROR_FLAG and will be blank if there is no ERROR.

how do i calculate rows where this FIELD is non-existant or blank ?

alternatively, how do i subtract ERROR_FEILD="Y" Count from Total Row count to get me this data.. all has to be done in real time.

[Ron_Naken · Accepted solution]

Calculating non-existent or blank can be done like this:

... NOT ERROR_FLAG=*

To count the rows where the field is not Y, including blank or missing:

... NOT ERROR_FLAG="Y" | stats count

NOTE: Using "<field>!=<value>" will not account for missing or empty fields. You should use the "NOT <field>=<value>" syntax.

[jrodman]

Not-Exist OR blank is a bit tricky. Try

(ERROR="" OR NOT ERROR="*")

[jrodman]

Oh, Ayn's solution is superior if it is really precisely as you describe.

[Ayn]

I think it will be easier to answer your question if you can provide us with some sample events. Once you have a working field extraction, the rest should pose no problems. If you've successfully extracted the field using name "error_field" for instance, you would just have to do

error_field!="Y"

I'm unsure what you mean by that it has to be done in real time. The field extractions will work on any search, regardless of what time range you choose (including real-time).

[Ayn]

I stand corrected. Thanks!

[Ron_Naken]

This method will not account for blank values or a missing field. See my answer to account for these.