Splunk Search

if-else condition

abhayneilam
Contributor

Can I use like this :

| eval a=if(Location!=" ",stat count by Location)

but I am getting error..

actually I want to find..I want to get the count for those records which are non-blank

Please help

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

I am not sure that you can use conditional searches, just conditional field calculation using eval.

another way is to make sure that the field location exits, then count
| WHERE NOT ( Location=" " OR isnull(Location) ) | stat count by Location

0 Karma

Ayn
Legend

You could also include it in the stats command directly:

stats count(eval(Location==" " OR isnull(Location))
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...