Splunk Search

Avoid rows less than certain number of alerts

manapuna
New Member

basic search | timechart span = 5m count by host | where count > 3
for today

10% of the time,the count is greater than 3. I only want those rows to display.

Please and thank you.

Tags (3)
0 Karma
1 Solution

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3

View solution in original post

0 Karma

mayurr98
Super Champion

hello

Well you can do that in the timechart itself using where clause.
You can try something like this

basic search | timechart span = 5m count by host WHERE count>3

See the example 4 given in this official doc of splunk.
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Timechart#Where_clause_Examples

let me know if this helps!

0 Karma

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3
0 Karma

manapuna
New Member

thank you. This is what I wanted.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...