Splunk Search

How to persist fields after group by command?

kimsej
Explorer

I have a query that does a group by, which allows the sum(diff) column to be calculated. 

[search] | stats sum(diff) by X_Request_ID as FinalDiff:

Screen Shot 2022-09-15 at 6.28.02 PM.png

From here, how can I list out only the entries that have a sum(diff) > 1? My attempt looks like:

[search] | stats sum(diff) by X_Request_ID as FinalDiff |where FinalDiff>1
 
My issue is that after the group by happens, the query seems to forget about the grouped sum and so I cannot compare it to 1. 
Labels (1)
0 Karma

thesplunkmonkey
Path Finder

Switch the order up a bit and it should work for you.

| stats sum(diff) as FinalDiff by X_Request_ID  |where FinalDiff>1

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...