COUNT_IF
The number of true values in the time window.
Syntax
COUNT_IF(VALUE)
Arguments
VALUE:
A BOOLEAN expression that can be either a calculated field or a column from the data streams. .
Returns
A number
AVAILABLE IN
Output Type: Availablity Aggregated Outputs: YES Explicit Lookup Table: YES Inline Joins\Lookups: YES
Example
Count number of sample events in general, and the number of security-related events specifically.
Data
{
"type":"event",
"id":"1",
"data":"sample data",
"extendeddata":"application"
}{
"type":"event",
"id":"2",
"data":"sample data",
"extendeddata":"security"
}{
"type":"event",
"id":"3",
"data":"sample data",
"extendeddata":"application"
}{
"type":"event",
"id":"5",
"data":"production data",
"extendeddata":"application"
}{
"type":"event",
"id":"7",
"data":"production data",
"extendeddata":"security"
}
Query:
SELECT
type,
COUNT_IF(data = 'sample data') as data,
COUNT_IF(data = 'sample data'
AND extendeddata = 'security') as security
FROM
stream
GROUP BY
type
Results:
type data security
event 3 1
Related Functions
COUNT COUNT(*) COUNT_DISTINCT COUNT_EACH
Dialog

Last updated
Was this helpful?