Splunk Search

How to persist fields after group by command?


I have a query that does a group by, which allows the sum(diff) column to be calculated. 

[search] | stats sum(diff) by X_Request_ID as FinalDiff:

Screen Shot 2022-09-15 at 6.28.02 PM.png

From here, how can I list out only the entries that have a sum(diff) > 1? My attempt looks like:

[search] | stats sum(diff) by X_Request_ID as FinalDiff |where FinalDiff>1
My issue is that after the group by happens, the query seems to forget about the grouped sum and so I cannot compare it to 1. 
Labels (1)
0 Karma

Path Finder

Switch the order up a bit and it should work for you.

| stats sum(diff) as FinalDiff by X_Request_ID  |where FinalDiff>1

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...