Splunk Search

Get the number of similar rows in table in splunk having count greater than 100

sanchitlohia
Explorer

I have a splunk query like this

index=main_branch* | table email_id file_size_in_bytes

I want to count for similar rows in this table and then return the row if the count of that row is greater than equal to say X. For eg if result is like this

a 2
a 4
c 4
c 4
c 5
b 1
a 2

and say X is 2 then I want result to 'a 2' and 'c 4' because the number of rows having 'a 2' and 'c 4' is greater then or equal to 2 which is the value of x here.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this..
Assuming X=2.

index=main_branch* | table email_id file_size_in_bytes | eventstats count by email_id file_size_in_bytes | where count > 2

OR

 index=main_branch* | stats count by email_id file_size_in_bytes | where count > 2 

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

index=main_branch* | where file_size_in_bytes >= 2 | dedup email_id file_size_in_bytes | table email_id file_size_in_bytes

Based on your comments, this should do the job.

index=main_branch* | eval filter=email_id.tostring(file_size_in_bytes) | stats dc(filter) as rowcount | where rowcount >= 100 | table email_id file_size_in_bytes
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's something I wish Splunk would change and makes your solution the better one.

---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
SplunkTrust
SplunkTrust

In your updated solution, after stats command the email_id and file_size_in_bytes fields are not available.

0 Karma

sanchitlohia
Explorer

Let me know if it is possible to do so in splunk or not

0 Karma

sanchitlohia
Explorer

No not like this , if you see the example I gave above , I want the similar rows having count greater than a number say X. For eg above "a 2" occurs twice and "c 4" appears thrice so they are included in the result as X is 2
"a 4" does not appear in the result as it appears only once

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...