Solved: How to filter results in timechart statistics tabl... - Splunk Community

Getting Data In

EventID = “ok”
| timechart span=1h count(EventID) by Login

Every hour I need to display only those values, where count(EventID)>5

I have used filter command (where) after timechart command but it didnt worked.

Please help me!
Thanks in advance!

1 Solution

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

View solution in original post

Solution

Not a clean solution but this should work

EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt > 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

APP DEVELOPER TECH TALK Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...