Get the number of similar rows in table in splunk having count greater than 100

[sanchitlohia]

I have a splunk query like this

index=main_branch* | table email_id file_size_in_bytes

I want to count for similar rows in this table and then return the row if the count of that row is greater than equal to say X. For eg if result is like this

a 2
a 4
c 4
c 4
c 5
b 1
a 2

and say X is 2 then I want result to 'a 2' and 'c 4' because the number of rows having 'a 2' and 'c 4' is greater then or equal to 2 which is the value of x here.

[somesoni2]

Try something like this..
Assuming X=2.

index=main_branch* | table email_id file_size_in_bytes | eventstats count by email_id file_size_in_bytes | where count > 2

OR

 index=main_branch* | stats count by email_id file_size_in_bytes | where count > 2 

[richgalloway]

Perhaps something like this?

index=main_branch* | where file_size_in_bytes >= 2 | dedup email_id file_size_in_bytes | table email_id file_size_in_bytes

Based on your comments, this should do the job.

index=main_branch* | eval filter=email_id.tostring(file_size_in_bytes) | stats dc(filter) as rowcount | where rowcount >= 100 | table email_id file_size_in_bytes

[richgalloway]

That's something I wish Splunk would change and makes your solution the better one.

[somesoni2]

In your updated solution, after stats command the email_id and file_size_in_bytes fields are not available.

[sanchitlohia]

Let me know if it is possible to do so in splunk or not

[sanchitlohia]

No not like this , if you see the example I gave above , I want the similar rows having count greater than a number say X. For eg above "a 2" occurs twice and "c 4" appears thrice so they are included in the result as X is 2
"a 4" does not appear in the result as it appears only once