Splunk Search

How to do a stats count by abc | where count > 2?

bijodev1
Communicator

Hey there,

I have a field let's say "abc" with values as such : 1,3,5,7,5,3,2,1,5,7,8,5,1,1,2,2,3,2,1,1,2,3,2,3

here what I am trying to look here is first do a stats count by abc | where count > 2 

and then again do a stats dc(abc) by "some other field"

 

I have tried do to it but unable to get any results not sure if there is any other option to perform it.

thanks

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

In general, you'd use eventstats (perform statistics without transforming original events) to do this:

Your base search
| eventstats count by abc | where count > 2 
| stats dc(abc) as abcs by other_field

There could be better performing options (e.g. do stats by both fields and then do filter and another stats but it depends upon your data and requirement. If you can share some sample data and full search that you want to perform, we may give some suggestions.

View solution in original post

bijodev1
Communicator

for the same one, if I have to pull the max and min for the stats values(abc) by some_field like how is it possible.

0 Karma

bijodev1
Communicator

@somesoni2  thank you, it worked.

0 Karma

somesoni2
Revered Legend

In general, you'd use eventstats (perform statistics without transforming original events) to do this:

Your base search
| eventstats count by abc | where count > 2 
| stats dc(abc) as abcs by other_field

There could be better performing options (e.g. do stats by both fields and then do filter and another stats but it depends upon your data and requirement. If you can share some sample data and full search that you want to perform, we may give some suggestions.

PickleRick
SplunkTrust
SplunkTrust

Use eventstats instead of stats if you don't want to lose the original data.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...