Splunk Search

How to exclude counts (stats count by) with a flat table format?

mcrawford44
Communicator

Weird one. I have a query that requires a flat format output with table;

index=foo | table name product publisher version

The output is such;

name1 product1 publisher1 version1
name1 product2 publisher2 version2
name1 product3 publisher3 version3

The data is a list of applications installed on a machine.

I want to exclude products where the total count is under 21. However I still need the flat table format above. The expanded name column/field. I can't seem to figure out how to both exclude products with a total count over 21, while still presenting the flat table view.

I CAN list the applications under 21 and filter in search, but there are 45000+ records for that and Chrome can't seem to handle it. Nor is that efficient in any way.

Any ideas?

I want these products excluded, but retain the flat table with expanded name;

index=foo | stats count by Product | where count < 21

Thanks!

Tags (4)
0 Karma

somesoni2
Revered Legend

@Strive answer should do the task for you.

Alternatively try this

index=foo [ search index=foo | stats count by Product | where count < 21 | table Product]| table name product publisher version

strive
Influencer

Try this

Your search for flat table ... | eventstats count as Count by name | where Count > 21 | fields - Count

If you need based on product field

Your search for flat table ... | eventstats count as Count by product | where Count > 21 | fields - Count
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...