Hi Splunk community,
I have this query
source=main |
transaction user_id |
chart count as Attempts, count(eval(isp_event_type!="authentication_succeeded")) as Failed, count(eval(isp_event_type="authentication_succeeded")) as Success by isp_provider |
eval percentage = round(Success / Attempts * 100, 1) |
eval "Login Percentage" = tostring(percentage) + "%" |
rename isp_provider as "ISP Provider" |
sort "Login Percentage" |
fields "ISP Provider" Attempts "Login Percentage" flag
I need to filter out those results where Attempts<1 from the results table. What is the best way of doing that?
Thanks!
Have you tried adding | where Attempts>1
at the end of your search?
You could even place the where
statement right after your chart
section before doing any evals.
Have you tried adding | where Attempts>1
at the end of your search?
You could even place the where
statement right after your chart
section before doing any evals.
Thank you! I was missing a pipe when trying this before. Now it works!