Splunk Search

How to subtract the first X number from count of a deduped field for a timechart?

jpriceit
Engager

I have a timechart that visualizes the monthly count of unique locations accessed, but I need to remove the first (in order of time) 10,000 unique locations. Here is my original search that builds the timechart:

search resulting in events with various Latitude and Longitude fields, some unique
    | eval LatNormalized=round(Latitude,5)
    | eval LongNormalized=round(Longitude,5)
    | eval LatLongNormalized=LatNormalized+","+LongNormalized
    | dedup LatLongNormalized sortby -LatNormalized,-LongNormalized
    | timechart span=1mon count(LatLongNormalized)

I tried to use the following to at least identify where the 10k mark was hit, and I could then just modify my time range to exclude that, however it isn't working:

same search base as above
| eval LatNormalized=round(Latitude,5)
| eval LongNormalized=round(Longitude,5)
| eval LatLongNormalized=LatNormalized+","+LongNormalized
| dedup LatLongNormalized sortby -LatNormalized,-LongNormalized, -date_month
| eventstats count(LatLongNormalized) as countLatLongNormalized
| streamstats range(countLatLongNormalized) as countRange
| head (countRange<10000)

This doesn't appear to be doing what I expected either, so I'm thinking I'm going about this completely wrong. Does anyone know how I could eliminate the results from my search containing the first 10,000 unique values of LatLongNormalized and only chart the subsequent counts?

0 Karma

somesoni2
Revered Legend

So if your monthly count for Jan is say 18000, you want to plot only 8000? What should happen if Feb count is less than 10000?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...