Dashboards & Visualizations

how to count the field with conditions

Dattasri
Loves-to-Learn

Dattasri_0-1712213665473.png

 

Labels (2)
0 Karma

KothariSurbhi
Loves-to-Learn Everything

Hello @Dattasri ,

You can use the below mentioned search query in which I have used the random function to generate values between 0 and 100, and then applied the `stats count` command.

| makeresults count=10
| eval rand=(random() % 100) + 1
| stats count(eval(rand > 60)) as count_greater_than_60, count(eval(rand < 60)) as count_less_than_60


If this reply helps you, Karma would be appreciated.

Thanks,
Surbhi

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can use appendpipe command for this - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendpipe

Either creating a temporary fields and counting them (which is a more straightforward solution)

| eval is_small=if(your_field<threshold,1,0)
| eval is_big=if(your_field>another_threshold,1,0)
| appendpipe sum(is_small) as "Small Values" sum(is_big) as "Big Values"

Alternatively to creating temporary fields you can use the eval-based stats like

sum(eval(if(your_field>another_threshold,1,0))) as "Big Values"

But this is more advanced functionality and this syntax can be a bit confusing.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...