Splunk Search

How to subtract the first X number from count of a deduped field for a timechart?

jpriceit
Engager

I have a timechart that visualizes the monthly count of unique locations accessed, but I need to remove the first (in order of time) 10,000 unique locations. Here is my original search that builds the timechart:

search resulting in events with various Latitude and Longitude fields, some unique
    | eval LatNormalized=round(Latitude,5)
    | eval LongNormalized=round(Longitude,5)
    | eval LatLongNormalized=LatNormalized+","+LongNormalized
    | dedup LatLongNormalized sortby -LatNormalized,-LongNormalized
    | timechart span=1mon count(LatLongNormalized)

I tried to use the following to at least identify where the 10k mark was hit, and I could then just modify my time range to exclude that, however it isn't working:

same search base as above
| eval LatNormalized=round(Latitude,5)
| eval LongNormalized=round(Longitude,5)
| eval LatLongNormalized=LatNormalized+","+LongNormalized
| dedup LatLongNormalized sortby -LatNormalized,-LongNormalized, -date_month
| eventstats count(LatLongNormalized) as countLatLongNormalized
| streamstats range(countLatLongNormalized) as countRange
| head (countRange<10000)

This doesn't appear to be doing what I expected either, so I'm thinking I'm going about this completely wrong. Does anyone know how I could eliminate the results from my search containing the first 10,000 unique values of LatLongNormalized and only chart the subsequent counts?

0 Karma

somesoni2
Revered Legend

So if your monthly count for Jan is say 18000, you want to plot only 8000? What should happen if Feb count is less than 10000?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...