Splunk Search

if-else condition

abhayneilam
Contributor

Can I use like this :

| eval a=if(Location!=" ",stat count by Location)

but I am getting error..

actually I want to find..I want to get the count for those records which are non-blank

Please help

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

I am not sure that you can use conditional searches, just conditional field calculation using eval.

another way is to make sure that the field location exits, then count
| WHERE NOT ( Location=" " OR isnull(Location) ) | stat count by Location

0 Karma

Ayn
Legend

You could also include it in the stats command directly:

stats count(eval(Location==" " OR isnull(Location))
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...