topic Using where in search in Splunk Search

Using where in search

balcv — Wed, 30 Sep 2020 02:10:58 GMT

I have the following search

index="pan" (dest_ip="192.168.*" AND NOT src_ip="192.168.*" AND NOT src_location="AU" AND NOT src_location="*-*" ) 
| chart count by src_location,action

This results in a nice stacked column chart showing actions (allowed & blocked) per src_location.
What I need to do is only show those src_locations where the total count (allowed + blocked) is greater than a specific value (eg totalCount >= 500).

I have tried using separate stats count by [field] as [name] statements then using eval to add them together but I can't get the results I'm wanting which is the stacked column graph by src_location showing allowed & blocked.

Any suggestions greatly appreciated.

Re: Using where in search

renjith_nair — Fri, 13 Sep 2019 03:18:28 GMT

@balcv ,

Try

index="pan" (dest_ip="192.168.*" AND NOT src_ip="192.168.*" AND NOT src_location="AU" AND NOT src_location="*-*" ) 
| chart count by src_location,action
| addtotals row=true fieldname=totalCount | where totalCount >= 500|fields - totalCount

Re: Using where in search

balcv — Fri, 13 Sep 2019 03:32:44 GMT

Awesome. Thanks for that @renjith.nair