How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

[pontorito]

I'm trying to count the number of occurrences of a field WITH values and the number of the same field WITHOUT values in the same search. I can't seem to return any counts for either eval statement. I am using HUNK.

base search | eval zip=(if(NOT LOCATION.postalCode="*",1,0)) | stats sum(zip) as count | eval noZip=(if(LOCATION.postalCode="*",1,0)) | stats sum(noZip)

[woodcock]

Try this:

base search | stats count AS total, count(eval(isnull(LOCATION.postalCode))) AS noZip | eval Zip = count - noZip

[sundareshr]

Couple of options you could try

base search | eval zip=if(LOCATION.postalCode="*", 1, 0) | stats count(eval(zip=1)) as wzip count(eval(zip=0)) as nozip 

OR

base search | stats count(eval(LOCATION.postalCode="*") as zip count as total | eval nozip=total-zip

[acharlieh]

I don't have experience with Hunk, but using just core Splunk would something like this work?

base search | stats count(LOCATION.postalCode) as countWith count(eval(isnull(LOCATION.postalCode))) as countWithout 

Alternatively if you need to use your evals and sums, if you move both evals to before the stats you could do both sums in one stats

base search | eval zip=... | eval noZip=... | stats sum(zip) as count sum(noZip)

[pontorito]

This is close..except the
count(eval(isnull(LOCATION.postalCode)))

statement still brings in records with the LOCATION.postalCode field. How can I incorporate a WHERE isnull(LOCATION.postalCode) into the eval?

[pontorito]

not sure why but it's not displaying correctly but in my query I do have an * between the quotes in both statements

[acharlieh]

Answers uses markdown for formatting, so without indenting 4 spaces it was intrepreting the * as markers for italics. but if you indent 4 spaces, it becomes a code block... https://daringfireball.net/projects/markdown/syntax