All Apps and Add-ons

Search Show result where count > 10

jonydupre
Path Finder

Hi,

Currently I use this search:

index=Linux | search host!="test*" | timechart span=1d count by HCS | timewrap 1w

To get the following result:
alt text
But as you can see, there are some results with 0 because of the count. I want to exclude everything that is zero.
I thought of something like this:

index=Linux | search host!="test*" | timechart span=1d count by HCS  where count >= 1| timewrap 1w

But that doesn't seem to work.. What would be a correct way of excluding zero values?
Thanks!

0 Karma
1 Solution

Sukisen1981
Champion

try this
index=Linux | search host!="test*" |bin span=1d _time | stats count by HCS,_time|where count >10|timechart span=1d values(count) by HCS| timewrap 1w

View solution in original post

0 Karma

jonydupre
Path Finder

When removing Timewrap the zero results won't show, I just have to set the time with the date picker in the top right.
If I can't solve it otherwise, I'll use this as a solution

0 Karma

Sukisen1981
Champion

try this
index=Linux | search host!="test*" |bin span=1d _time | stats count by HCS,_time|where count >10|timechart span=1d values(count) by HCS| timewrap 1w

0 Karma

jonydupre
Path Finder

I actually want to remove only the zero values, so >=1 should be ok. Should've stated in the title. But anyway, when using your search (With >=1 or >1) I get the same results, only the results that where higher than 1 previously are now all 1. So for example the 77 on november 2th is now 1.. Not sure why the results are being modified to 1?

0 Karma

Sukisen1981
Champion

I am sorry, pehaps I am not able to grasp.
You want a timechart of the values whose count is >0?
If yes, then you can just modify the timechart part of the query above to something like this:
previous stuff...|timechart span=1d values(count) by HCS|..rest of the stuff

0 Karma

jonydupre
Path Finder

No problem, I indeed want the results to not show 0 so >=1 or >0 should work. When I show results with 0 the line chart and legend of the line chart get really cluttered with unusefull data. So that's my reason get rid of them.

You mean like this?:

index=Linux HCS "NOT OK" | search host!="test*" | bin span=1d _time | stats count by _time,HCS |timechart span=1d count by HCS where count > 1| timewrap 1w

Then all results are still 0 or 1. Results with more than 1 are changed to 1.. Not sure why?
Thanks for your assistance!

0 Karma

Sukisen1981
Champion

index=Linux HCS "NOT OK" | search host!="psas*" host!="pccc*" host!="pisefibl*" host!="psapsap*" host=p* | bin span=1d _time | stats count by _time,HCS |timechart span=1d values(count) by HCS where count > 1

modified the timechart portion a bit to get the vlaues of the count. check first without timewrap and then with timewrap

0 Karma

jonydupre
Path Finder

This works indeed. Both with and without timewrap. But can you explain why _time and HCS is in count and in the next pipe, you count HCS again?

Thanks a lot!

0 Karma

Sukisen1981
Champion

The point is if you apply a straight timechart without the stats command, you will get an output with time as first column and the names of the HCS field from column 2 onwards.
Now, that is not what you needed. the key here are the bin and the stats commands.
the bin is used to split time into 1 day intervals. the stats counts the HCS values against the time split of 1 day each.
Remove all code after the stats and see the output, you will get 3 columns, _time, the field names for HCS and a third column 'count'.
Now , I simply take the values of the count, values(count) and apply a timechart.
The reason why my first code was just giving you 1 or 0 is because i was using timechart count, which was merely counting the count (occurences) of the stats command output and not the values of the count as you wanted.
I am sure if you see the output till the stats command after removing rest of the code , you will understand.
Please accept the answer if this resolves your issue 🙂

kamlesh_vaghela
SplunkTrust
SplunkTrust
0 Karma

jonydupre
Path Finder

The amount of results vary each day, so using top 10 would sometimes show less results than there actually are since I would only show top 10.. And in days where there are not so many results, it would also show the results with 0 and 1 if you know what I mean. Or did I miss something in the topic?

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...