Splunk Search

How do you use an aggregated value as a filter?

New Member

Hello,

I need to use an aggregated value as a filter.

The search returns multiple rows, and I need only those with count > 30.

index=*production*  ERROR AND NOT DEBUG | eval svc=mvindex(split(index,"-"),4) | eventstats count as TOTAL_COUNT | stats latest(TOTAL_COUNT) as TC count by svc

Please kept.

Thank you

0 Karma

SplunkTrust
SplunkTrust

@ygaluzo

Can you please try this?

index=*production* ERROR AND NOT DEBUG 
| eval svc=mvindex(split(index,"-"),4) 
| stats count as TC count by svc  | where TC > 30
0 Karma