Splunk Search
Highlighted

Can you help me use the where command to limit results?

New Member

I have a search that works perfectly. It lists the number of calls by area code by state. However, I'm trying to limit the results to only display area codes that have 500 or more hits.

Here's my search...

sourcetype="VHT:HPIQ:IVROutput" DNIS  "Success" | eval ac=substr(DNIS,2,3) | lookup areacode.csv areacode as ac OUTPUT state | stats count(ac) by state | sort -count(ac)

I've tried using the where command, but I can't seem to get the syntax correct. I'm sure it's a very simple answer but I am only 1 month into my Spunk learning.

Thanks for the help.

Tags (1)
0 Karma
Highlighted

Re: Can you help me use the where command to limit results?

SplunkTrust
SplunkTrust

@muzicman61,
Try,

sourcetype="VHT:HPIQ:IVROutput" DNIS "Success" | eval ac=substr(DNIS,2,3) | lookup areacode.csv areacode as ac OUTPUT state 
| stats count(ac)  as ac by state | where ac>=500

View solution in original post

0 Karma
Highlighted

Re: Can you help me use the where command to limit results?

New Member

Thank you... I was close but it kept giving me errors. I knew the solution would be simple.

0 Karma