splunk query with if condition

[Nith1]

Hi Team

i want to display the success and failure count for that i have only one field i.e

b_failed="false"

using this i could get the success count how can i get the count of jobs that are failed 

Below is the query and it doesnt return the failure count

....|eval status=if(b_failed="false","success","failed")
    |stats count(status) as count

can someone please correct me
Thanks

[harsmarvania57 · Accepted solution]

Try this

|stats sum(eval(if(b_failed="false",1,0))) as success_count, sum(eval(if(b_failed="false",0,1))) as failed_count

[isoutamo]

Hi

check stats + eval from this page https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Stats

I think that this is your solution.

r. Ismo