
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
count, distinct, if
So I want to count the entries where the state is 'CRIT', but distinct the entries with the same names.
It is a bit like this:
count(DISTINCT[name]) but with the condition If(state='CRIT', 1, 0))
If(state='CRIT', 1, 0))
count(DISTINCT[name])
- Tags:
- script
Accepted Solutions


- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have all the bits you need there, just need to put them together.
The thing you can use to your advantage is that the COUNT function (DISTINCT or otherwise) does not count NULLs, so you just have to put a null in where it is not the type you wish to count:
count(DISTINCT If(service_state='CRIT', alias, null()))
That should do the trick.
Steve

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try to use set analysis where possible because it performs way better than IFs.
In your case:
count({<state={'CRIT'}>} DISTINCT([name]))


- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have all the bits you need there, just need to put them together.
The thing you can use to your advantage is that the COUNT function (DISTINCT or otherwise) does not count NULLs, so you just have to put a null in where it is not the type you wish to count:
count(DISTINCT If(service_state='CRIT', alias, null()))
That should do the trick.
Steve

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much @stevedark !!! helped me a lot

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try to use set analysis where possible because it performs way better than IFs.
In your case:
count({<state={'CRIT'}>} DISTINCT([name]))


- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
D'oh! Focussed on answering the question in hand that I missed that there was a much better way of achieving the same thing.
Thanks for posting a better way.
