https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499393#M194987 <P>Here is my current query:</P> <P>index=abc* |stats count by user,date |eval highcount=(if count &gt;=1000,1000,count) </P> <P>This gives me output like this:</P> <P>user1 200 200<BR /> user2 34 34<BR /> user3 1200 1000 --&gt; I want to stop counting for this user once high count reaches 1000 and continue counting other users as it finds.</P> <P>Thanks</P> Fri, 29 Nov 2019 17:36:06 GMT rvalli 2019-11-29T17:36:06Z https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499393#M194987 <P>Here is my current query:</P> <P>index=abc* |stats count by user,date |eval highcount=(if count &gt;=1000,1000,count) </P> <P>This gives me output like this:</P> <P>user1 200 200<BR /> user2 34 34<BR /> user3 1200 1000 --&gt; I want to stop counting for this user once high count reaches 1000 and continue counting other users as it finds.</P> <P>Thanks</P> Fri, 29 Nov 2019 17:36:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499393#M194987 rvalli 2019-11-29T17:36:06Z https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499394#M194988 <P>I think I figured:<BR /> index=abc* |stats count by user,date |eval count=(if count &gt;=1000,1000,count) </P> <P>Is there a better way to do this?</P> Fri, 29 Nov 2019 17:52:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499394#M194988 rvalli 2019-11-29T17:52:26Z https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499395#M194989 <P>Do you want to reduce search time?</P> <P>Splunk basically searches for search criteria within the search period.</P> Sat, 30 Nov 2019 04:41:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499395#M194989 to4kawa 2019-11-30T04:41:51Z https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499396#M194990 <P>Yes please ,Yes please.</P> Sat, 30 Nov 2019 11:44:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499396#M194990 rvalli 2019-11-30T11:44:37Z https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499397#M194991 <P>First of all, what is the purpose and duration of the search?(Do you want to count the number of users?)</P> <P>Please provide a sample log.</P> <P>How many items are you searching for?</P> Sat, 30 Nov 2019 23:36:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499397#M194991 to4kawa 2019-11-30T23:36:32Z https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499398#M194992 <P>Like this:</P> <PRE><CODE>index=abc* | stats count BY user date | eval count = min(1000, count) </CODE></PRE> Sun, 01 Dec 2019 22:36:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-until-a-specific-number-and-go-to-next-value-in/m-p/499398#M194992 woodcock 2019-12-01T22:36:56Z