How to persist fields after group by command? - Splunk Community

Splunk Search

I have a query that does a group by, which allows the sum(diff) column to be calculated.

[search] | stats sum(diff) by X_Request_ID as FinalDiff:

Screen Shot 2022-09-15 at 6.28.02 PM.png

From here, how can I list out only the entries that have a sum(diff) > 1? My attempt looks like:

[search] | stats sum(diff) by X_Request_ID as FinalDiff |where FinalDiff>1

My issue is that after the group by happens, the query seems to forget about the grouped sum and so I cannot compare it to 1.

Switch the order up a bit and it should work for you.

| stats sum(diff) as FinalDiff by X_Request_ID |where FinalDiff>1

Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...