Count objects grouped by transaction

[mpdharley]

I need to count the number objects grouped by a transaction command. The command is:

index=* sourcetype="pan:*"
| transaction src_ip maxspan=2min
| table src_ip, app

I need to provide a count for "app" and then limit the results to only those groups with more than 5 apps returned within the time frame.

Thank you,

Mike

[scelikok · Accepted solution]

Hi @mpdharley,

Please try below;

index=* sourcetype="pan:*"
| transaction src_ip maxspan=2min
| stats dc(app) as count values(app) as app by src_ip
| where count>5

[mpdharley]

Worked perfectly, thanks!