topic Re: Threshold stats count table in Splunk Search

Threshold stats count table

hartfoml — Mon, 19 Nov 2012 17:37:27 GMT

I want to use stats count with several fields and am running my search every hour

I don't want to show any results unless the total count is greater than 50

I had this eventtype=foo | stats count | where count > 50

I what to do this eventtype=foo | stats count by field1 field2 field3 | where Total_Count > 50

I could use "accum" but this will most often only give me the last line and I want all lines if the total of all lines are above 50

I tried eventtype=foo | streamstats count | where count > 50 | stats count by field1 field2 field3 but this did not work

alacercogitatus — Mon, 19 Nov 2012 18:19:05 GMT

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

hartfoml — Mon, 19 Nov 2012 20:16:49 GMT

this worked thanks much