Splunk Search

How to chart by count, but only if the count is over a given number?

jleppert
New Member

I'm trying to get a graph based on this:

timechart span=1h count by src_ip

However, I only want to display results if the count is over a given number. How can I do this? I tried |where count>100, but not working.

Tags (3)
0 Karma
1 Solution

ramdaspr
Contributor

Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.

The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.

The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.

|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count

View solution in original post

ramdaspr
Contributor

Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.

The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.

The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.

|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count

jleppert
New Member

... thanks again!

0 Karma

jleppert
New Member

Thanks, it works as expected!

0 Karma

jleppert
New Member

This works well for a bar chart but for a line chart, it does not connect a src-ip count from one hour to the next. Is there a way to do that?

0 Karma

ramdaspr
Contributor

Are you using this query on a dashboard or on the search panel?

If on the search panel, use the formatting option to set Null Value to zero

If on the dashboard, set

<option name="charting.chart.nullValueMode">zero</option>

This will force the chart to connect but dip to zero if a particular hour doesnt have any data.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...