Splunk Search

How to exclude counts (stats count by) with a flat table format?

mcrawford44
Communicator

Weird one. I have a query that requires a flat format output with table;

index=foo | table name product publisher version

The output is such;

name1 product1 publisher1 version1
name1 product2 publisher2 version2
name1 product3 publisher3 version3

The data is a list of applications installed on a machine.

I want to exclude products where the total count is under 21. However I still need the flat table format above. The expanded name column/field. I can't seem to figure out how to both exclude products with a total count over 21, while still presenting the flat table view.

I CAN list the applications under 21 and filter in search, but there are 45000+ records for that and Chrome can't seem to handle it. Nor is that efficient in any way.

Any ideas?

I want these products excluded, but retain the flat table with expanded name;

index=foo | stats count by Product | where count < 21

Thanks!

Tags (4)
0 Karma

somesoni2
Revered Legend

@Strive answer should do the task for you.

Alternatively try this

index=foo [ search index=foo | stats count by Product | where count < 21 | table Product]| table name product publisher version

strive
Influencer

Try this

Your search for flat table ... | eventstats count as Count by name | where Count > 21 | fields - Count

If you need based on product field

Your search for flat table ... | eventstats count as Count by product | where Count > 21 | fields - Count
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...