How to create search to return rows in table based on count?

johnsasikumar — Mon, 22 Apr 2019 10:32:07 GMT

I have a splunk query that forms table like this

Time    Type    Msg
10/1/2019 0:00  1   xyz
10/2/2019 0:00  2   xyz
10/3/2019 0:00  3   xyz
10/4/2019 0:00  4   xyz
10/5/2019 0:00  1   xyz
10/6/2019 0:00  1   xyz
10/7/2019 0:00  2   xyz
10/8/2019 0:00  2   xyz
10/9/2019 0:00  3   xyz
10/10/2019 0:00 3   xyz
10/11/2019 0:00 4   xyz
10/12/2019 0:00 3   xyz

How do i retain only the rows in the table where the count(type) is <3. So in this case i want the rows with type 4 to be removed because the count of events is less than 3.

Re: How to create search to return rows in table based on count?

VatsalJagani — Mon, 22 Apr 2019 12:44:04 GMT

Hi @johnsansikumar,
Please append below query after your existing query. (If you want to keep Type which has count less than 3, change where condition otherwise)

| eventstats count by Type | where count<3

Hope this helps!!

topic How to create search to return rows in table based on count? in Splunk Search

How to create search to return rows in table based on count?

Re: How to create search to return rows in table based on count?