Upsolver
Search…
COUNT_IF
The number of true values in the time window.

Syntax

COUNT_IF(VALUE)

Arguments

VALUE: A BOOLEAN expression that can be either a calculated field or a column from the data streams. .

Returns

A number

AVAILABLE IN

Output Type: Availablity Aggregated Outputs: YES Explicit Lookup Table: YES Inline Joins\Lookups: YES

Example

Count number of sample events in general, and the number of security-related events specifically.

Data

1
{
2
"type":"event",
3
"id":"1",
4
"data":"sample data",
5
"extendeddata":"application"
6
}{
7
"type":"event",
8
"id":"2",
9
"data":"sample data",
10
"extendeddata":"security"
11
}{
12
"type":"event",
13
"id":"3",
14
"data":"sample data",
15
"extendeddata":"application"
16
}{
17
"type":"event",
18
"id":"5",
19
"data":"production data",
20
"extendeddata":"application"
21
}{
22
"type":"event",
23
"id":"7",
24
"data":"production data",
25
"extendeddata":"security"
26
}
Copied!

Query:

1
SELECT
2
type,
3
COUNT_IF(data = 'sample data') as data,
4
COUNT_IF(data = 'sample data'
5
AND extendeddata = 'security') as security
6
FROM
7
stream
8
GROUP BY
9
type
Copied!

Results:

type data security event 3 ‌ 1

Dialog