Splunk Search

Avoid rows less than certain number of alerts

manapuna
New Member

basic search | timechart span = 5m count by host | where count > 3
for today

10% of the time,the count is greater than 3. I only want those rows to display.

Please and thank you.

Tags (3)
0 Karma
1 Solution

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3

View solution in original post

0 Karma

mayurr98
Super Champion

hello

Well you can do that in the timechart itself using where clause.
You can try something like this

basic search | timechart span = 5m count by host WHERE count>3

See the example 4 given in this official doc of splunk.
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Timechart#Where_clause_Examples

let me know if this helps!

0 Karma

splunker12er
Motivator

try this,

basesearch| bucket _time span=5m|stats count by host , _time| where count >3
0 Karma

manapuna
New Member

thank you. This is what I wanted.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...