Splunk Search

Exclude search result

polymorphic
Communicator

Hi all

This might be very straight forward, but i cant get my head around it, so i hope someone is able to help me out.

The task is to show every hostname with a value greater than 5 on failedpct.

This is my search:

sourcetype=stats | stats first(customername) as customer, last(monPingGWCheck) AS upstatus, count, count(FailedModulesString) AS failedcount by hostname | eval failedpct=failedcount/count*100 | eval failedpct=if(upstatus == 1, failedpct, 0) | sort customer, -failedpct | table customer, hostname, upstatus, count, failedcount, failedpct

Any suggestion?

Tags (1)
0 Karma
1 Solution

Ayn
Legend
... | where failedpct>5

View solution in original post

Ayn
Legend
... | where failedpct>5

polymorphic
Communicator

As i said, VERY straight forward. 🙂
Thank you very much.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...