Solved: Re: How to filter results in timechart statistics ... - Splunk Community

Getting Data In

EventID = “ok”
| timechart span=1h count(EventID) by Login

Every hour I need to display only those values, where count(EventID)>5

I have used filter command (where) after timechart command but it didnt worked.

Please help me!
Thanks in advance!

1 Solution

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

View solution in original post

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...