Splunk Search

How to get a direct count of results which are over a certain amount?

mcram52
New Member

I've set up the following search with a count of events based on specific time frames over a week span:

index=epackage flow_event=Package* containsAmendedReport="false"
| eval Time2 = strptime(strftime(_time,"%F"),"%F"),
   Quad = case(
    _time > (Time2 + (09*3600)) AND _time < (Time2 + (11*3600)),"1st",
    _time > (Time2 + (11*3600)) AND _time < (Time2 + (13*3600)),"2nd",
    _time > (Time2 + (13*3600)) AND _time < (Time2 + (15*3600)),"3rd",
     _time > (Time2 + (15*3600)) AND _time < (Time2 + (17*3600)),"4th")
| timechart span=1d sum(numberOfReports) as count by Quad

The results table then looks like this: alt text

How might I go about getting a direct count of the instances where the result was over 300? I've tried using |stats dc but it hasn't been working and I'm not sure why. Any suggestions?

Tags (1)
0 Karma

mayurr98
Super Champion

Not sure what exactly is your query but are you trying to get this?

index=epackage flow_event=Package* containsAmendedReport="false" 
| eval Time2 = strptime(strftime(_time,"%F"),"%F"),
    Quad = case(
    _time > (Time2 + (09*3600)) AND _time < (Time2 + (11*3600)),"1st",
    _time > (Time2 + (11*3600)) AND _time < (Time2 + (13*3600)),"2nd",
    _time > (Time2 + (13*3600)) AND _time < (Time2 + (15*3600)),"3rd",
    _time > (Time2 + (15*3600)) AND _time < (Time2 + (17*3600)),"4th") 
| bin _time span=1d 
| stats sum(numberOfReports) as count by Quad 
| where count> 300 
| stats dc(Quad)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...