Splunk Search

Get the number of similar rows in table in splunk having count greater than 100

sanchitlohia
Explorer

I have a splunk query like this

index=main_branch* | table email_id file_size_in_bytes

I want to count for similar rows in this table and then return the row if the count of that row is greater than equal to say X. For eg if result is like this

a 2
a 4
c 4
c 4
c 5
b 1
a 2

and say X is 2 then I want result to 'a 2' and 'c 4' because the number of rows having 'a 2' and 'c 4' is greater then or equal to 2 which is the value of x here.

Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this..
Assuming X=2.

index=main_branch* | table email_id file_size_in_bytes | eventstats count by email_id file_size_in_bytes | where count > 2

OR

 index=main_branch* | stats count by email_id file_size_in_bytes | where count > 2 

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

index=main_branch* | where file_size_in_bytes >= 2 | dedup email_id file_size_in_bytes | table email_id file_size_in_bytes

Based on your comments, this should do the job.

index=main_branch* | eval filter=email_id.tostring(file_size_in_bytes) | stats dc(filter) as rowcount | where rowcount >= 100 | table email_id file_size_in_bytes
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's something I wish Splunk would change and makes your solution the better one.

---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

In your updated solution, after stats command the email_id and file_size_in_bytes fields are not available.

0 Karma

sanchitlohia
Explorer

Let me know if it is possible to do so in splunk or not

0 Karma

sanchitlohia
Explorer

No not like this , if you see the example I gave above , I want the similar rows having count greater than a number say X. For eg above "a 2" occurs twice and "c 4" appears thrice so they are included in the result as X is 2
"a 4" does not appear in the result as it appears only once

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...