Splunk Search
Highlighted

How to chart by count, but only if the count is over a given number?

New Member

I'm trying to get a graph based on this:

timechart span=1h count by src_ip

However, I only want to display results if the count is over a given number. How can I do this? I tried |where count>100, but not working.

Tags (3)
0 Karma
Highlighted

Re: How to chart by count, but only if the count is over a given number?

Contributor

Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.

The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.

The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.

|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count

View solution in original post

Highlighted

Re: How to chart by count, but only if the count is over a given number?

New Member

Thanks, it works as expected!

0 Karma
Highlighted

Re: How to chart by count, but only if the count is over a given number?

New Member

This works well for a bar chart but for a line chart, it does not connect a src-ip count from one hour to the next. Is there a way to do that?

0 Karma
Highlighted

Re: How to chart by count, but only if the count is over a given number?

Contributor

Are you using this query on a dashboard or on the search panel?

If on the search panel, use the formatting option to set Null Value to zero

If on the dashboard, set

<option name="charting.chart.nullValueMode">zero</option>

This will force the chart to connect but dip to zero if a particular hour doesnt have any data.

0 Karma
Highlighted

Re: How to chart by count, but only if the count is over a given number?

New Member

... thanks again!

0 Karma