Splunk Search

How do I chart "number of values that are at least"/"number of values that are X or more"

Raistlan
Explorer

Sample data:

alpha   2
beta    1
gamma   4
delta   3
epsilon 10
zeta    13
eta     3
theta   8
iota    4
kappa   6

The number of entries with a value of at least 1: 10

The number of entries with a value of at least 2: 9

The number of entries with a value of at least 3: 8

The number of entries with a value of at least 4: 6

The number of entries with a value of at least 5: 4

The number of entries with a value of at least 6: 4

The number of entries with a value of at least 7: 3

The number of entries with a value of at least 8: 3

The number of entries with a value of at least 9: 2

The number of entries with a value of at least 10: 2

The number of entries with a value of at least 11: 1

The number of entries with a value of at least 12: 1

The number of entries with a value of at least 13: 1

The chart would be these points: (1,10) (2,9) (3,8) (4,6) (5,4) (6,4) (7,3) (8,3) (9,2) (10,2) (11,1) (12,1) (13,1)

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Assuming that you have this extracted as two fields - let's call them "myfield" and "count"

This search language is pretty advanced. And it's a good bet that there's more than one way.

Remember that coming out of the first clause I assume you have a field called "count".

*your search terms here* | eval countAs=mvrange(0,100) | eval countAs=mvindex(countAs,0,count) | mvexpand countAs | stats count by countAs

In english, I give every row a multivalued field called "countAs", whose values are the integers from 0 to 100. For each row I then clip off all the integers above whatever the "count" value for that row is. Then I 'mvexpand' on that field, meaning where I had one row with a multivalued countAs field whose values were "0 1 2", I now have three rows with a single-valued countAs field whose values are those values respectively.

At that point the stats command just has to count up how many rows there are for each value of "countAs".

I also make the assumption that each value of "myfield" appears only once in the incoming rows. If that's not true then replace the final "count" with "dc(myfield)"

View solution in original post

sideview
SplunkTrust
SplunkTrust

Assuming that you have this extracted as two fields - let's call them "myfield" and "count"

This search language is pretty advanced. And it's a good bet that there's more than one way.

Remember that coming out of the first clause I assume you have a field called "count".

*your search terms here* | eval countAs=mvrange(0,100) | eval countAs=mvindex(countAs,0,count) | mvexpand countAs | stats count by countAs

In english, I give every row a multivalued field called "countAs", whose values are the integers from 0 to 100. For each row I then clip off all the integers above whatever the "count" value for that row is. Then I 'mvexpand' on that field, meaning where I had one row with a multivalued countAs field whose values were "0 1 2", I now have three rows with a single-valued countAs field whose values are those values respectively.

At that point the stats command just has to count up how many rows there are for each value of "countAs".

I also make the assumption that each value of "myfield" appears only once in the incoming rows. If that's not true then replace the final "count" with "dc(myfield)"

Raistlan
Explorer

Thanks, this worked well. I did tweak it with somesoni2's changes and to not have 100 hardcoded:
your search terms here | eventstats max(count) as rangeHigh | eval countAs=mvrange(1,rangeHigh) | eval countAs=mvindex(countAs,0,count-1) | mvexpand countAs | stats count by countAs

0 Karma

somesoni2
Revered Legend

Amazing approach!!!.

I believe it needs little change to achieve the correct result.

your search terms here | eval countAs=mvrange(1,100) | eval countAs=mvindex(countAs,0,count-1) | mvexpand countAs | stats count by countAs

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...