Splunk Search

How to create search to return rows in table based on count?

johnsasikumar
Path Finder

I have a splunk query that forms table like this

Time    Type    Msg
10/1/2019 0:00  1   xyz
10/2/2019 0:00  2   xyz
10/3/2019 0:00  3   xyz
10/4/2019 0:00  4   xyz
10/5/2019 0:00  1   xyz
10/6/2019 0:00  1   xyz
10/7/2019 0:00  2   xyz
10/8/2019 0:00  2   xyz
10/9/2019 0:00  3   xyz
10/10/2019 0:00 3   xyz
10/11/2019 0:00 4   xyz
10/12/2019 0:00 3   xyz

How do i retain only the rows in the table where the count(type) is <3. So in this case i want the rows with type 4 to be removed because the count of events is less than 3.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @johnsansikumar,
Please append below query after your existing query. (If you want to keep Type which has count less than 3, change where condition otherwise)

| eventstats count by Type | where count<3

Hope this helps!!

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...