topic Re: How do i get a count of each value of a field, and then extract the values whose count matches a certain number in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544807#M154270 <P>Actually there was no need for me to store the values in a new field. Thanks</P> Mon, 22 Mar 2021 17:17:49 GMT ezmo1982 2021-03-22T17:17:49Z How do i get a count of each value of a field, and then extract the values whose count matches a certain number https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544013#M154093 <P>Hi,</P><P>I have the below SPL which gets the count of each value of the field named "subject". I want to be able to select the values whose count is greater than 5. For example, if the search below returned 10 results, but only 2 had a count greater than 5, how can I pick those two values out and store them in new fields that i can reference after.&nbsp;</P><P>index=email_log RejType="Virus Signature Detection" | stats count by subject</P><P>Thanks!</P> Tue, 16 Mar 2021 14:32:40 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544013#M154093 ezmo1982 2021-03-16T14:32:40Z Re: How do i get a count of each value of a field, and then extract the values whose count matches a certain number https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544032#M154106 <P>So you want to filter to only the subjects that have a count greater than 5?&nbsp;</P><P><SPAN>index=email_log RejType="Virus Signature Detection"<BR />| stats count by subject<BR />| where count&gt;5</SPAN></P> Tue, 16 Mar 2021 16:45:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544032#M154106 peter_krammer 2021-03-16T16:45:52Z Re: How do i get a count of each value of a field, and then extract the values whose count matches a certain number https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544046#M154110 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225682">@ezmo1982</a>&nbsp;, Above search should give you first half or your requirement (filtering fields values whose count&gt;5). For 2nd requirement (saving to a new field), please provide more information on what you intend to do with these values.&nbsp;</P> Tue, 16 Mar 2021 18:17:09 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544046#M154110 somesoni2 2021-03-16T18:17:09Z Re: How do i get a count of each value of a field, and then extract the values whose count matches a certain number https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544807#M154270 <P>Actually there was no need for me to store the values in a new field. Thanks</P> Mon, 22 Mar 2021 17:17:49 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-get-a-count-of-each-value-of-a-field-and-then-extract/m-p/544807#M154270 ezmo1982 2021-03-22T17:17:49Z