topic Re: stats values in Splunk Search

stats values

vumanhtai — Tue, 24 Mar 2020 08:04:41 GMT

Hi Splunk Team!
i have a query: index=mail sourcetype=webmail | stats values(time) as time values(severity) as severity values(email) as email values(status) by session_ID
Results as shown in a picture
i want to show result of values (severity) greater than 2 values?
how can i do it?
Thanks!

Re: stats values

kamlesh_vaghela — Tue, 24 Mar 2020 08:24:26 GMT

@vumanhtai

Are you looking for this?

YOUR_SEARCH | where mvcount(severity) > 2

Re: stats values

vumanhtai — Tue, 24 Mar 2020 08:26:40 GMT

Thank you so much!

Re: stats values

gcusello — Tue, 24 Mar 2020 08:28:59 GMT

Hi @vumanhtai,
let me understand, do you want to have session_IDs where:

there's a severity value greater than 2,
there are more than 2 different severity values?

In the first case, try this:

index=mail sourcetype=webmail 
| stats values(time) as time maxs(severity) as severity values(email) as email values(status) by session_ID
| where severity>2

In the second case, try this:

index=mail sourcetype=webmail 
| stats values(time) as time values(severity) as severity dc(severity) as dc_severity values(email) as email values(status) by session_ID
| where dc_severity>2

Ciao.
Giuseppe

Re: stats values

vumanhtai — Tue, 24 Mar 2020 08:45:48 GMT

thank you
kamlesh_vaghela's answer helped me solve this problem

Re: stats values

kamlesh_vaghela — Tue, 24 Mar 2020 11:39:59 GMT

@vumanhtai

Glad to help you. Please accept this answer to close this question.