topic Re: Filtering based on quantity of list() results in Splunk Search

Filtering based on quantity of list() results

Sam2 — Mon, 28 Sep 2020 17:03:36 GMT

Hello all,

I have this search:

...| streamstats window=1 global=false current=f last(_time) as next_time by cs_host,username| eval gap = next_time - _time |search gap>350| stats list(gap) by cs_host,username

which draws a nice table, grouped by list(gap). However, I'd like to remove any rows in the table that only have one results of list(gap), but am struggling with the syntax. Can anyone help please?

Re: Filtering based on quantity of list() results

martin_mueller — Mon, 14 Jul 2014 08:49:06 GMT

How about this:

... | streamstats window=1 global=false current=f last(_time) as next_time by cs_host,username| eval gap = next_time - _time | search gap>350 | stats count list(gap) by cs_host username | where count > 1

Re: Filtering based on quantity of list() results

Sam2 — Mon, 14 Jul 2014 09:31:15 GMT

Yes, that works! I think I was trying to over complicate it!