Splunk Search

Avoid rows less than certain number of alerts

manapuna
New Member

basic search | timechart span = 5m count by host | where count > 3
for today

10% of the time,the count is greater than 3. I only want those rows to display.

Please and thank you.

Tags (3)
0 Karma
1 Solution

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3

View solution in original post

0 Karma

mayurr98
Super Champion

hello

Well you can do that in the timechart itself using where clause.
You can try something like this

basic search | timechart span = 5m count by host WHERE count>3

See the example 4 given in this official doc of splunk.
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Timechart#Where_clause_Examples

let me know if this helps!

0 Karma

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3
0 Karma

manapuna
New Member

thank you. This is what I wanted.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...