Solved: How to filter results in timechart statistics tabl... - Splunk Community

Getting Data In

EventID = “ok”
| timechart span=1h count(EventID) by Login

Every hour I need to display only those values, where count(EventID)>5

I have used filter command (where) after timechart command but it didnt worked.

Please help me!
Thanks in advance!

1 Solution

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

View solution in original post

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...