Splunk Search

not getting empty row value count when doing count by fields.

satishachary199
New Member

i have four filed in a csv file, where some time , one filed value coming as empty, as like below
field1 , field2, field3, field4
DBW DCAR XTY XXS
DBW DCAR XTY XXF
LG DPORT XXS
LG DPORT XTY XXF

Like ,above data when i am doing "count by field1,field2,field3,field4 " not getting the count of empty value.

Thanks in Advance

Tags (1)
0 Karma

Williammbrooks
New Member

We can specify columns we want to calculate in two ways:
COUNT(*) will count all rows in all the columns. The result will be taken from the column that has the highest result.
COUNT(FIELD_NAME) that will calculate the row for a particular field (column).
Furthermore, we can use the COUNT function with or without the DISTINCT clause:
COUNT to count all the rows even if there are duplications of data.
COUNT( DISTINCT ...) to calculate unique rows (rows with same values will not be counted). You can visit my site for more details.

0 Karma

somesoni2
Revered Legend

If any of the field used in by clause of stats command is null, the whole row is dropped. What type of stats you want to do? I believe you'd need to use fillnull before stats to replace null value with some string e.g. N/A, and then do the stats so that you'd get count for all combinations.

0 Karma

satishachary199
New Member

thank you , followed the same , got solution.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...