Splunk Search

Distinct count higher than a value ?

atanasmitev
Path Finder

Hello all,

I am trying to search for distinct count higher than a value.
Below is what I tried, obfuscated :

stats dc(var1) as some_name by var2 which returns a column of values , say {1, 55, 2200, 45, 100, .. etc}
How do I extract from that column values higher than a "limit" ?

I tried

stats dc(var1) as some_name by var2 | search some_name > limit, but it doesn't work

Ideas ?

Tags (3)
1 Solution

lguinn2
Legend

If limit is a field, you can't use search - you need to use where

yoursearchhere
stats dc(var1) as some_name by var2 
| where some_name > limit

If limit is a literal, you can use either search or where

yoursearchhere
stats dc(var1) as some_name by var2 
| search some_name > 7

View solution in original post

lguinn2
Legend

If limit is a field, you can't use search - you need to use where

yoursearchhere
stats dc(var1) as some_name by var2 
| where some_name > limit

If limit is a literal, you can use either search or where

yoursearchhere
stats dc(var1) as some_name by var2 
| search some_name > 7

atanasmitev
Path Finder

Thanks, it worked like a charm, it seems I have to RTFM more often 🙂

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...