Splunk Search

How to get a direct count of results which are over a certain amount?

mcram52
New Member

I've set up the following search with a count of events based on specific time frames over a week span:

index=epackage flow_event=Package* containsAmendedReport="false"
| eval Time2 = strptime(strftime(_time,"%F"),"%F"),
   Quad = case(
    _time > (Time2 + (09*3600)) AND _time < (Time2 + (11*3600)),"1st",
    _time > (Time2 + (11*3600)) AND _time < (Time2 + (13*3600)),"2nd",
    _time > (Time2 + (13*3600)) AND _time < (Time2 + (15*3600)),"3rd",
     _time > (Time2 + (15*3600)) AND _time < (Time2 + (17*3600)),"4th")
| timechart span=1d sum(numberOfReports) as count by Quad

The results table then looks like this: alt text

How might I go about getting a direct count of the instances where the result was over 300? I've tried using |stats dc but it hasn't been working and I'm not sure why. Any suggestions?

Tags (1)
0 Karma

mayurr98
Super Champion

Not sure what exactly is your query but are you trying to get this?

index=epackage flow_event=Package* containsAmendedReport="false" 
| eval Time2 = strptime(strftime(_time,"%F"),"%F"),
    Quad = case(
    _time > (Time2 + (09*3600)) AND _time < (Time2 + (11*3600)),"1st",
    _time > (Time2 + (11*3600)) AND _time < (Time2 + (13*3600)),"2nd",
    _time > (Time2 + (13*3600)) AND _time < (Time2 + (15*3600)),"3rd",
    _time > (Time2 + (15*3600)) AND _time < (Time2 + (17*3600)),"4th") 
| bin _time span=1d 
| stats sum(numberOfReports) as count by Quad 
| where count> 300 
| stats dc(Quad)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...