topic Re: Search based on field value occurances in Splunk Search

Search based on field value occurances

jturnerrdba — Thu, 02 May 2013 20:15:39 GMT

I'm trying to define a search that would output only the events that are related to a value of a field that occur at least X number of times.

So for instance, If I have a field named "Username" and a list of 100 events that contain that field. For sake of argument we'll say that there are 10 users that would display as values for the field "username". Lets also say that I have 2 users, "Bob" and "Mike", that show up more than 10 times each. I want a search that would output all events that contained "Bob" and "Mike" as values of "Username" based off the fact that there are more than 10 events for those users.

Re: Search based on field value occurances

kristian_kolb — Thu, 02 May 2013 20:41:47 GMT

your base search here | eventstats count by Username | where count>10

Ought to work.

/Kristian

Re: Search based on field value occurances

jturnerrdba — Fri, 03 May 2013 13:36:57 GMT

That works perfectly, and much simpler than I thought it would be. Thanks very much.