topic Re: Remove all events of a client based on one or more values of field in Splunk Search

Remove all events of a client based on one or more values of field

rel82wi — Tue, 09 Nov 2021 14:01:05 GMT

Hi there

Im trying to filter my search results based on numerical top values of a field.

For example. I have 5k events as customer purchases. I want a list of all customers, who have never paid more than 10.

Or the other way, I want to filter out all customer events of customers, which have a purchase event with a value in a field higher than 10.

Which command could I use?

delete removes the events from the index. I only want to filter my search results.

if i filter for "field<=10" I do only get the events that have purchases, which are smaller than 10, but the list contains customer, which have paid mor than 10 and only removed those specific events.

Re: Remove all events of a client based on one or more values of field

PickleRick — Tue, 09 Nov 2021 14:48:29 GMT

Use eventstats to be able to filter events based on stats. For example

<your search> | eventstats max(price) as custmaxprice by user | where custmaxprice>10

Question is - is this what you want 🙂

Re: Remove all events of a client based on one or more values of field

rel82wi — Tue, 09 Nov 2021 15:20:23 GMT

Unfortunately I guess not.

If a customer has an event with purchase >10 I want this customer to be completely filtered out of the result.

Your search I think gives me all maximum prices the customers paid.

Re: Remove all events of a client based on one or more values of field

ITWhisperer — Tue, 09 Nov 2021 15:46:44 GMT

Just reverse the inequality from @PickleRick 's solution

<your search> | eventstats max(price) as custmaxprice by user | where custmaxprice < 10

Re: Remove all events of a client based on one or more values of field

PickleRick — Wed, 10 Nov 2021 11:04:26 GMT

Of course. The original post stated "I want a list of customers who never paid more than 10". I can't read 😄

Thx for correcting.