Splunk Search

How to get a direct count of results which are over a certain amount?

mcram52
New Member

I've set up the following search with a count of events based on specific time frames over a week span:

index=epackage flow_event=Package* containsAmendedReport="false"
| eval Time2 = strptime(strftime(_time,"%F"),"%F"),
   Quad = case(
    _time > (Time2 + (09*3600)) AND _time < (Time2 + (11*3600)),"1st",
    _time > (Time2 + (11*3600)) AND _time < (Time2 + (13*3600)),"2nd",
    _time > (Time2 + (13*3600)) AND _time < (Time2 + (15*3600)),"3rd",
     _time > (Time2 + (15*3600)) AND _time < (Time2 + (17*3600)),"4th")
| timechart span=1d sum(numberOfReports) as count by Quad

The results table then looks like this: alt text

How might I go about getting a direct count of the instances where the result was over 300? I've tried using |stats dc but it hasn't been working and I'm not sure why. Any suggestions?

Tags (1)
0 Karma

mayurr98
Super Champion

Not sure what exactly is your query but are you trying to get this?

index=epackage flow_event=Package* containsAmendedReport="false" 
| eval Time2 = strptime(strftime(_time,"%F"),"%F"),
    Quad = case(
    _time > (Time2 + (09*3600)) AND _time < (Time2 + (11*3600)),"1st",
    _time > (Time2 + (11*3600)) AND _time < (Time2 + (13*3600)),"2nd",
    _time > (Time2 + (13*3600)) AND _time < (Time2 + (15*3600)),"3rd",
    _time > (Time2 + (15*3600)) AND _time < (Time2 + (17*3600)),"4th") 
| bin _time span=1d 
| stats sum(numberOfReports) as count by Quad 
| where count> 300 
| stats dc(Quad)
0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...