I need to count the number objects grouped by a transaction command. The command is:
index=* sourcetype="pan:*"
| transaction src_ip maxspan=2min
| table src_ip, app
I need to provide a count for "app" and then limit the results to only those groups with more than 5 apps returned within the time frame.
Thank you,
Mike
Hi @mpdharley,
Please try below;
index=* sourcetype="pan:*"
| transaction src_ip maxspan=2min
| stats dc(app) as count values(app) as app by src_ip
| where count>5
Hi @mpdharley,
Please try below;
index=* sourcetype="pan:*"
| transaction src_ip maxspan=2min
| stats dc(app) as count values(app) as app by src_ip
| where count>5
Worked perfectly, thanks!