Splunk Search

Exclude events that do not occur each day from search

C4r7m4n
Path Finder

Hello

I have this search:

earliest=-7d@d latest=@d  source="/var/log/snmptrapfmt.log" (timeout_url="*.GE" OR timeout_url="*.tv" OR unavailable) AND NOT (timeout_url="*.com") | timechart count by timeout_url

and the result of this search is here: http://imageshack.us/photo/my-images/10/mollq.jpg/

Does somebody know how to remove/exclude from search events that do not occur in each day e.g. l(pink), w(dark green)

Tags (3)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Perhaps this will help you...

your_search | eventstats dc(date_wday) AS daysaweek by url | where daysaweek > 6

Perhaps...

/kristian

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

Perhaps this will help you...

your_search | eventstats dc(date_wday) AS daysaweek by url | where daysaweek > 6

Perhaps...

/kristian

0 Karma

C4r7m4n
Path Finder

Thanks @kristian.kolb, it's working 😉

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...