Splunk Search

How can I get a count of entries where one value is 0 or greater than 0?

BearMormont
Path Finder

I have a Splunk Query that is returning data, similar to:

ComputerName    NumVulns
Computer1             10
Computer2              0
Computer3             27
Computer4              0
Computer5            100

And I would like to convert that output to a count of machines where NumVulns is 0 or NumVulns is greater than 0. Something like:

ComputerWithVulns - 3
ComputerWithoutVulns - 2

Ultimately I want to put this into a pie chart, but I am new to Splunk and not sure how to proceed. I've read up on eval and count but so far none of my attempts have been successful.

Thanks!

0 Karma
1 Solution

BearMormont
Path Finder

Figured it out myself:

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

View solution in original post

0 Karma

BearMormont
Path Finder

Figured it out myself:

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

0 Karma

BearMormont
Path Finder

Figured it out myself.

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

0 Karma

micahkemp
Champion

Great! You may consider converting this comment to an answer and accepting it so that others may find the answer more easily.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...