Splunk Search

How to chart by count, but only if the count is over a given number?

jleppert
New Member

I'm trying to get a graph based on this:

timechart span=1h count by src_ip

However, I only want to display results if the count is over a given number. How can I do this? I tried |where count>100, but not working.

Tags (3)
0 Karma
1 Solution

ramdaspr
Contributor

Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.

The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.

The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.

|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count

View solution in original post

ramdaspr
Contributor

Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.

The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.

The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.

|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count

jleppert
New Member

... thanks again!

0 Karma

jleppert
New Member

Thanks, it works as expected!

0 Karma

jleppert
New Member

This works well for a bar chart but for a line chart, it does not connect a src-ip count from one hour to the next. Is there a way to do that?

0 Karma

ramdaspr
Contributor

Are you using this query on a dashboard or on the search panel?

If on the search panel, use the formatting option to set Null Value to zero

If on the dashboard, set

<option name="charting.chart.nullValueMode">zero</option>

This will force the chart to connect but dip to zero if a particular hour doesnt have any data.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...