Splunk Search

How do I create a chart that only shows columns with greater than 1000 events?

mrb113
Engager

I'm trying to make a stacked column chart showing how users are changing some setting ("powerChanged") by build.

Here's my search which is doing the trick to create a chart showing what the users are changing that setting to.

index = "power" name = "powerChanged" isTest = "False" isOnBattery=False buildSku="Enterprise" (build>=2500 AND build<=5900)  |  eval powerDiff= ABS( oldPower-newPower) 
| where powerDiff>5 AND powerDiff<100 | 
| chart count(newPower) as "Count" over build by newPower span=10 |

However, some of the builds only have 5-10 users whereas our production builds have thousands of users, making it difficult to look for trends. In the chart, how can I discard builds which have fewer than 1000 results?

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index = "power" name = "powerChanged" isTest = "False" isOnBattery=False buildSku="Enterprise" (build>=2500 AND build<=5900)
|  eval powerDiff= ABS( oldPower-newPower) 
| where powerDiff>5 AND powerDiff<100 
| stats count by build newPower
| evenstats sum(count) AS newPowerCount BY newPower 
| where newPowerCount >=1000
| chart sum(count) as Count over build by newPower span=10

View solution in original post

woodcock
Esteemed Legend

Like this:

index = "power" name = "powerChanged" isTest = "False" isOnBattery=False buildSku="Enterprise" (build>=2500 AND build<=5900)
|  eval powerDiff= ABS( oldPower-newPower) 
| where powerDiff>5 AND powerDiff<100 
| stats count by build newPower
| evenstats sum(count) AS newPowerCount BY newPower 
| where newPowerCount >=1000
| chart sum(count) as Count over build by newPower span=10

somesoni2
Revered Legend

Give this a try

index = "power" name = "powerChanged" isTest = "False" isOnBattery=False buildSku="Enterprise" (build>=2500 AND build<=5900)  |  eval powerDiff= ABS( oldPower-newPower) 
 | where powerDiff>5 AND powerDiff<100 
 | stats count by build newPower | where count>=1000
 | chart sum(count) as Count over build by newPower span=10
0 Karma

mrb113
Engager

Thanks for helping a newbie out 🙂 This is close, but rather than "where count>1000", I want something like "where sum(count)>=1000" to reflect builds with 1000 users across all values of newPower, rather than builds with 1000 users at each newPower value.
Of course, I can't express it this way - I'll spend some more time thinking...

0 Karma

somesoni2
Revered Legend

In that case you need the answer provided by @woodcock below, which does exactly the same.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...