Splunk Search

How can I get a count of entries where one value is 0 or greater than 0?

BearMormont
Path Finder

I have a Splunk Query that is returning data, similar to:

ComputerName    NumVulns
Computer1             10
Computer2              0
Computer3             27
Computer4              0
Computer5            100

And I would like to convert that output to a count of machines where NumVulns is 0 or NumVulns is greater than 0. Something like:

ComputerWithVulns - 3
ComputerWithoutVulns - 2

Ultimately I want to put this into a pie chart, but I am new to Splunk and not sure how to proceed. I've read up on eval and count but so far none of my attempts have been successful.

Thanks!

0 Karma
1 Solution

BearMormont
Path Finder

Figured it out myself:

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

View solution in original post

0 Karma

BearMormont
Path Finder

Figured it out myself:

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

0 Karma

BearMormont
Path Finder

Figured it out myself.

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

0 Karma

micahkemp
Champion

Great! You may consider converting this comment to an answer and accepting it so that others may find the answer more easily.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...