Splunk Search

How to do a stats count by abc | where count > 2?

bijodev1
Communicator

Hey there,

I have a field let's say "abc" with values as such : 1,3,5,7,5,3,2,1,5,7,8,5,1,1,2,2,3,2,1,1,2,3,2,3

here what I am trying to look here is first do a stats count by abc | where count > 2 

and then again do a stats dc(abc) by "some other field"

 

I have tried do to it but unable to get any results not sure if there is any other option to perform it.

thanks

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

In general, you'd use eventstats (perform statistics without transforming original events) to do this:

Your base search
| eventstats count by abc | where count > 2 
| stats dc(abc) as abcs by other_field

There could be better performing options (e.g. do stats by both fields and then do filter and another stats but it depends upon your data and requirement. If you can share some sample data and full search that you want to perform, we may give some suggestions.

View solution in original post

bijodev1
Communicator

for the same one, if I have to pull the max and min for the stats values(abc) by some_field like how is it possible.

0 Karma

bijodev1
Communicator

@somesoni2  thank you, it worked.

0 Karma

somesoni2
Revered Legend

In general, you'd use eventstats (perform statistics without transforming original events) to do this:

Your base search
| eventstats count by abc | where count > 2 
| stats dc(abc) as abcs by other_field

There could be better performing options (e.g. do stats by both fields and then do filter and another stats but it depends upon your data and requirement. If you can share some sample data and full search that you want to perform, we may give some suggestions.

PickleRick
Ultra Champion

Use eventstats instead of stats if you don't want to lose the original data.

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...