Solved: How to filter results in timechart statistics tabl... - Splunk Community

Getting Data In

EventID = “ok”
| timechart span=1h count(EventID) by Login

Every hour I need to display only those values, where count(EventID)>5

I have used filter command (where) after timechart command but it didnt worked.

Please help me!
Thanks in advance!

1 Solution

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

View solution in original post

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

Get Updates on the Splunk Community!

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...