Splunk Search

How to achieve search that If count is less than 0 change it to 0?

Skysurfer
Explorer

Can someone please help me with this.

 I have looking for a query so that if count is less than 0 change it to 0, otherwise display actual count.

for example, if the count is -23, the result should be count=0 and if the count is 23, the result should be count=23.

Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @Skysurfer,

it's hard for me to imagine that a count can be less then zero!

If anyway, you mean a sum called count, you can use an eval like this:

| eval count=if(count>0,count,0)

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @Skysurfer,

it's hard for me to imagine that a count can be less then zero!

If anyway, you mean a sum called count, you can use an eval like this:

| eval count=if(count>0,count,0)

Ciao.

Giuseppe

Skysurfer
Explorer

@gcusello @Thank you, it worked.

Shouldn’t have put it as count as count itself has a different meaning in splunk. It was actually  a field value that I was getting by doing some stats sum.

Ciao

0 Karma

gcusello
Esteemed Legend

Hi @Skysurfer,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...