Dashboards & Visualizations

how to count the field with conditions

Dattasri
Loves-to-Learn

Dattasri_0-1712213665473.png

 

Labels (2)
0 Karma

KothariSurbhi
Loves-to-Learn Everything

Hello @Dattasri ,

You can use the below mentioned search query in which I have used the random function to generate values between 0 and 100, and then applied the `stats count` command.

| makeresults count=10
| eval rand=(random() % 100) + 1
| stats count(eval(rand > 60)) as count_greater_than_60, count(eval(rand < 60)) as count_less_than_60


If this reply helps you, Karma would be appreciated.

Thanks,
Surbhi

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can use appendpipe command for this - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendpipe

Either creating a temporary fields and counting them (which is a more straightforward solution)

| eval is_small=if(your_field<threshold,1,0)
| eval is_big=if(your_field>another_threshold,1,0)
| appendpipe sum(is_small) as "Small Values" sum(is_big) as "Big Values"

Alternatively to creating temporary fields you can use the eval-based stats like

sum(eval(if(your_field>another_threshold,1,0))) as "Big Values"

But this is more advanced functionality and this syntax can be a bit confusing.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...