Splunk Search

## Capture the peak points in a table

Path Finder

I have a great search that someone here helped me with the other day. It will take all the peak numbers in a search and add them. This works great, but now I need to filter out numbers lower than 4. My current search looks like this and works.

``````| table _time, idle
| rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0)
| accum sno | eventstats max("Idle Time") as max by sno
| where 'Idle Time'=max | table _time "Idle Time"
| stats sum("Idle Time") as "Idle Time"
``````

So if my numbers look like:

0,1,2,3,0,0,1,2,3,4,5,0,1,2,3,4,5

I would get a total of 13 because it adds the peaks of 3+5+5. User don't want to see peaks under 4. I thought I could just add a |where idle < 4 at the beginning of the search, but that does not give the correct number. In my example I would expect to see 10 because 3 would be thrown out.

Tags (4)
1 Solution
Revered Legend

Try like this

``````| table _time, idle
| rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0)
| accum sno | eventstats max("Idle Time") as max by sno
| where 'Idle Time'=max  AND 'Idle Time'>4| table _time "Idle Time"
| stats sum("Idle Time") as "Idle Time"
``````
Revered Legend

Try like this

``````| table _time, idle
| rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0)
| accum sno | eventstats max("Idle Time") as max by sno
| where 'Idle Time'=max  AND 'Idle Time'>4| table _time "Idle Time"
| stats sum("Idle Time") as "Idle Time"
``````
Path Finder

Thanks that did it!

SplunkTrust

You could add a `where > 4` which will exclude anything less than 4

``````| table _time, idle
| rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0)
| accum sno | eventstats max("Idle Time") as max by sno
| where 'Idle Time'=max | table _time "Idle Time"
| stats sum("Idle Time") as "Idle Time"  | where idle > 4
``````
Path Finder

I thought the same thing and tried that as I mentioned above, but used it at the beginning of the search. Somehow that messes up the part that calculates the peaks. When you do that it will show the total of the highest peak instead of adding all the peaks like I need it to do.

Get Updates on the Splunk Community!

#### Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

#### Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

#### User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...