Splunk Search

How to only show stats max(value) where min(value) is greater than 0 in the last 5 minutes?

chriselst
Engager

Hi all, just getting started and trying to get something together quickly to show management so forgive asking what is probably a trivial question.

I have a log file which is written to each minute with a count of messages in a number of queues. I have a chart showing those queues with a none zero count over the last five minutes.

source=".log" id="queue.*" value>0 | stats max(value) by id

I want it to only display queues where the count has not been zero in the previous five minutes as I only care about queues that are not emptying.

I have tried things along the lines of

source=".log" id="queue.*" value>0 | stats max(value) by id | where min(value) > 0

But cannot get it right, can someone point me in the right direction please.

Tags (4)
0 Karma
1 Solution

vganjare
Builder

HI,

Following query should help:

source=".log" id="queue.*"  | stats max(value) as MAX, min(value) as MIN by id | where MIN  > 0

Thanks!!

View solution in original post

vganjare
Builder

HI,

Following query should help:

source=".log" id="queue.*"  | stats max(value) as MAX, min(value) as MIN by id | where MIN  > 0

Thanks!!

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...