https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-ignore-single-events-in-transaction/m-p/164017#M46584 <P>Good idea. Thanks. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 24 Feb 2014 20:48:24 GMT albyva 2014-02-24T20:48:24Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-ignore-single-events-in-transaction/m-p/164015#M46582 <P>I'm using (transaction) to count the number of events in a stream of data.<BR /> There are numerous single events, but I'm only interested in events that are 2 or more.<BR /> Using the string maxevent=X, I can limit the maximum number of events within a given time span,<BR /> but can you ignore a number of events less than a given number (ie: minevents=2)???</P> <P>index=generic | transaction data maxevents=2 maxspan=2m</P> Mon, 24 Feb 2014 20:26:49 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-ignore-single-events-in-transaction/m-p/164015#M46582 albyva 2014-02-24T20:26:49Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-ignore-single-events-in-transaction/m-p/164016#M46583 <P>Any transaction command adds fields like duration and eventcount. You can filter based on field eventcount.</P> <PRE><CODE>index=generic | transaction data maxspan=2m | where eventcount &gt; 1 </CODE></PRE> Mon, 24 Feb 2014 20:42:31 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-ignore-single-events-in-transaction/m-p/164016#M46583 somesoni2 2014-02-24T20:42:31Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-ignore-single-events-in-transaction/m-p/164017#M46584 <P>Good idea. Thanks. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 24 Feb 2014 20:48:24 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-ignore-single-events-in-transaction/m-p/164017#M46584 albyva 2014-02-24T20:48:24Z