Splunk Search

How do i get a count of each value of a field, and then extract the values whose count matches a certain number

ezmo1982
Path Finder

Hi,

I have the below SPL which gets the count of each value of the field named "subject". I want to be able to select the values whose count is greater than 5. For example, if the search below returned 10 results, but only 2 had a count greater than 5, how can I pick those two values out and store them in new fields that i can reference after. 

index=email_log RejType="Virus Signature Detection" | stats count by subject

Thanks!

Labels (2)
Tags (4)
1 Solution

peter_krammer
Communicator

So you want to filter to only the subjects that have a count greater than 5? 

index=email_log RejType="Virus Signature Detection"
| stats count by subject
| where count>5

View solution in original post

ezmo1982
Path Finder

Actually there was no need for me to store the values in a new field. Thanks

0 Karma

peter_krammer
Communicator

So you want to filter to only the subjects that have a count greater than 5? 

index=email_log RejType="Virus Signature Detection"
| stats count by subject
| where count>5

somesoni2
Revered Legend

@ezmo1982 , Above search should give you first half or your requirement (filtering fields values whose count>5). For 2nd requirement (saving to a new field), please provide more information on what you intend to do with these values. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...