Splunk Search

How to chart values only where 2 or more values are returned?

ulikabbq
Path Finder

I am using a chart function as follows:

| chart count, values(status) by user

and I only want to get back the results that have 2 or more statuses. I have tried some eval commands but I haven't gotten anything to work properly.

Tags (2)
1 Solution

aweitzman
Motivator

Try this:

| chart count, values(status) as allStatuses by user | where mvcount(allStatuses) > 1

View solution in original post

aweitzman
Motivator

Try this:

| chart count, values(status) as allStatuses by user | where mvcount(allStatuses) > 1

yannK
Splunk Employee
Splunk Employee

you can use the distinct count too

| chart count, values(status) as allStatuses, dc(status) AS distinct_statuses by user | where distinct_statuses > 1 | fields - distinct_statuses

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...