How to list a count ONLY if the value within a query is above a certain threshold?

[CTHolt01]

Hello. Today, I have several panels in a dashboard to provide us daily, weekly, and monthly counts of certain problem areas. When it comes to one of the scripts though, I would like to only provide a count if the number is higher than 10. Below is one of the queries we currently have in place:

<panel>
  <title>Today</title>
  <table>
    <title>Kickouts for CSC</title>
    <search>
      <query>host=hfs-p2-ma-a* source=*console.log "Pinging" | stats count as Total</query>
      <earliest>@d</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">100</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">none</option>
    <option name="rowNumbers">1</option>
    <option name="table.drilldown">all</option>
    <option name="table.sortDirection">asc</option>
    <option name="table.wrap">1</option>
    <option name="type">raw</option>
  </table>
</panel>

Also, below are examples of the output in splunk today in order to gather those counts:

STATUS | wrapper | main | 2018/09/06 16:47:38.283 | Pinging the JVM took 11 seconds to respond.
STATUS | wrapper | main | 2018/09/06 16:47:38.283 | Pinging the JVM took 2 seconds to respond.
STATUS | wrapper | main | 2018/09/06 16:47:10.731 | Pinging the JVM took 11 seconds to respond.
STATUS | wrapper | main | 2018/09/06 16:47:10.731 | Pinging the JVM took 2 seconds to respond.

We know that a "kick out" takes place if the Pinging takes longer than 10 seconds today. Is there a way to rewrite the query to only count if the pinging takes longer than 10 seconds or is it something where we would have to rewrite the regular expression to read something like --> Pinging the JVM took [0-9][1-9] seconds to respond.

Any help would be greatly appreciated!

-Cameron

[horsefez]

Hi @CTHolt01,

just add the following to your base search.

| search Total>10

Should look like this:
host=hfs-p2-ma-a* source=*console.log "Pinging" | stats count as Total | search Total>10

[horsefez]

Hi @CTHolt01,

was I able to help you with my solution?
Need any further assistance?

[adonio]

... | where count > 10

also, in general it is always better to assign a new field name to the count (or other functions).
so .... | more search ... | stats count as event_count | ... more stuff if needed ... | where event_count > 10