Splunk Search

splunk query with if condition

Nith1
Path Finder

Hi Team

i want to display the success and failure count for that i have only one field i.e

b_failed="false"

using this i could get the success count how can i get the count of jobs that are failed 

Below is the query and it doesnt return the failure count

....|eval status=if(b_failed="false","success","failed")
    |stats count(status) as count

can someone please correct me
Thanks

Labels (3)
Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Try this

|stats sum(eval(if(b_failed="false",1,0))) as success_count, sum(eval(if(b_failed="false",0,1))) as failed_count

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Try this

|stats sum(eval(if(b_failed="false",1,0))) as success_count, sum(eval(if(b_failed="false",0,1))) as failed_count

isoutamo
SplunkTrust
SplunkTrust

Hi

check stats + eval from this page https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Stats

I think that this is your solution.

r. Ismo

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...