Splunk Search

Avoid rows less than certain number of alerts

manapuna
New Member

basic search | timechart span = 5m count by host | where count > 3
for today

10% of the time,the count is greater than 3. I only want those rows to display.

Please and thank you.

Tags (3)
0 Karma
1 Solution

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3

View solution in original post

0 Karma

mayurr98
Super Champion

hello

Well you can do that in the timechart itself using where clause.
You can try something like this

basic search | timechart span = 5m count by host WHERE count>3

See the example 4 given in this official doc of splunk.
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Timechart#Where_clause_Examples

let me know if this helps!

0 Karma

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3
0 Karma

manapuna
New Member

thank you. This is what I wanted.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...