topic Re: How to exclude counts (stats count by) with a flat table format? in Splunk Search

How to exclude counts (stats count by) with a flat table format?

mcrawford44 — Fri, 22 Aug 2014 15:44:36 GMT

Weird one. I have a query that requires a flat format output with table;

index=foo | table name product publisher version

The output is such;

name1 product1 publisher1 version1
name1 product2 publisher2 version2
name1 product3 publisher3 version3

The data is a list of applications installed on a machine.

I want to exclude products where the total count is under 21. However I still need the flat table format above. The expanded name column/field. I can't seem to figure out how to both exclude products with a total count over 21, while still presenting the flat table view.

I CAN list the applications under 21 and filter in search, but there are 45000+ records for that and Chrome can't seem to handle it. Nor is that efficient in any way.

Any ideas?

I want these products excluded, but retain the flat table with expanded name;

index=foo | stats count by Product | where count < 21

Thanks!

Re: How to exclude counts (stats count by) with a flat table format?

strive — Fri, 22 Aug 2014 15:59:29 GMT

Try this

Your search for flat table ... | eventstats count as Count by name | where Count > 21 | fields - Count

If you need based on product field

Your search for flat table ... | eventstats count as Count by product | where Count > 21 | fields - Count

Re: How to exclude counts (stats count by) with a flat table format?

somesoni2 — Fri, 22 Aug 2014 21:08:18 GMT

@Strive answer should do the task for you.

Alternatively try this

index=foo [ search index=foo | stats count by Product | where count < 21 | table Product]| table name product publisher version