Splunk Search

How to chart values only where 2 or more values are returned?

ulikabbq
Path Finder

I am using a chart function as follows:

| chart count, values(status) by user

and I only want to get back the results that have 2 or more statuses. I have tried some eval commands but I haven't gotten anything to work properly.

Tags (2)
1 Solution

aweitzman
Motivator

Try this:

| chart count, values(status) as allStatuses by user | where mvcount(allStatuses) > 1

View solution in original post

aweitzman
Motivator

Try this:

| chart count, values(status) as allStatuses by user | where mvcount(allStatuses) > 1

yannK
Splunk Employee
Splunk Employee

you can use the distinct count too

| chart count, values(status) as allStatuses, dc(status) AS distinct_statuses by user | where distinct_statuses > 1 | fields - distinct_statuses

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...