Splunk Search

Avoid rows less than certain number of alerts

manapuna
New Member

basic search | timechart span = 5m count by host | where count > 3
for today

10% of the time,the count is greater than 3. I only want those rows to display.

Please and thank you.

Tags (3)
0 Karma
1 Solution

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3

View solution in original post

0 Karma

mayurr98
Super Champion

hello

Well you can do that in the timechart itself using where clause.
You can try something like this

basic search | timechart span = 5m count by host WHERE count>3

See the example 4 given in this official doc of splunk.
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Timechart#Where_clause_Examples

let me know if this helps!

0 Karma

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3
0 Karma

manapuna
New Member

thank you. This is what I wanted.

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...