Splunk Search

How to do stats count based on condition?

csahoo
Explorer
index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| stats count(eval(status="Received")) as received count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event



where as the
source : - is my application name
event :- Type of request whether synchronous request or Asynchronous request
labeltype : - Different type of label
sourcenodecode and geocode :- is the shopcode and shopregion from where the label is requested
received - no of label request received
failed - no of label request failed


Now i want to find the received and failed request count based on sourceNodeCode, geoCode, LabelType, event

But for failed request count i want to add condition -

in case of synchronous request or event the failed count should fetch from '*gps-request-processor-test*' application

in case of asynchronous request or event the failed count should fetch from "*gps-external-processor-test*" OR "*gps-artifact-processor-test*" application

The output should look something similar to this attached o/p.

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

So this is to add one more condition to the selection command I described in Re: Count based on condition. (If that original problem is solved, please mark an answer as solution.) All you need to do is to exclude Failed from the restrictive condition, i.e.,

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*"
 OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| where status!="Failed" OR (event == "Sync" AND source like "%gps-request-processor%" OR event == "Async")
 AND (source like "%gps-external-processor%" OR source like "%gps-artifact-processor%")
| stats count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| eval  failedevent=if(status="Failed" AND ((event="Sync" AND sourceNodeCode="gps-request-processor-test") OR (event="Async" AND (sourceNodeCode="gps-external-processor-test" OR sourceNodeCode="gps-artifact-processor-test"))), 1, 0)
| stats count(eval(status="Received")) as received sum(failedevent) as failed by sourceNodeCode geoCode LabelType event
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...