topic Using event count with a table in Splunk Search

Using event count with a table

thisemailwillbe — Fri, 29 Aug 2025 18:59:49 GMT

Hi all,

Here is my current search:

source=health.log REGION=region1 STATE=down TYPE=type1

What I want to do: I want the table to only display results if the region/state/type combination has happened 5 times in the past hour.

I tried using stats count, but I couldn't get it to work and also use table to output the multiple fields.

I must be not understanding something because this seems like it should be fairly easy to do...

ITWhisperer — Fri, 29 Aug 2025 19:03:54 GMT

source=health.log REGION=region1 STATE=down TYPE=type1 | stats count by REGION STATE TYPE | where count >= 5

or, if you want the events which are included in these stats

source=health.log REGION=region1 STATE=down TYPE=type1 | eventstats count by REGION STATE TYPE | where count >= 5

thisemailwillbe — Fri, 29 Aug 2025 19:18:30 GMT

Thanks! This was a really easy solution, I don't know why I didn't think of doing multiple fields...