How to limit results with a condition before retrieving the final results

[smirambe]

Dear experts,

I apologize but I am new on Splunk and I have a question which can be really simple for you ...

I have just uploaded a file Inside Splunk for SAP jobs analyzing. The format is really simple :
JobName | StartDate | Duration

I have retrieved the jobs with the highest execution duration by the search -> stats count(JobName) avg(Duration_sec) by JobName

However, I want to add the following condition "Only the JobName with more than 100 exécutions should be counted".

How can I modify my query ?

Thanks really in advance.

Regards.

Stéphane

[smirambe]

Thanks really for all, both solutions work perfectly. The second one is perhaps simplest ...

[richgalloway · Accepted solution]

Perhaps this is what you are looking for.

stats count(JobName) as Executions avg(Duration_sec) by JobName | where Executions > 100

[TiagoTLD1]

Hi

1st scenario: gives you the jobs that were executed more than 100 times

| stats count(JobName) AS COUNTER avg(Duration_sec) AS AVG_DURATION by JobName | where COUNTER>100 | table JobName, AVG_DURATION

2nd scenario: if you want to calculate the avg_duration of jobs that were executed more than 100 times, you can do this:

| eventstats count(JobName) AS COUNTER by JobName | where COUNTER>100 | stats avg(Duration) as AVG_DURATION by JobName | table JobName, AVG_DURATION

That returns only the