Splunk Search

How to write a search to filter and only return results for a field with a count greater than 2?

rgtsplunk
Explorer

It seems that this should be a simple filter, but we cannot seem to find out how to do this in Splunk.

We do a search, returning a UserID and a Source_Address. We would like to show all the source addresses for the given UserID, but only if the number of source addresses for that UserID is greater than 2.

We can use "stats distinct_count(Source_Address) as num_sources BY UserID | search num_sources > 2", but the output of that no longer has the actual Source Addresses for us to show - only the number. The "where" clause does not specify a way of counting by UserID, nor does anything else, it appears.

The only other thing we can see is to do the whole search as a sub-search, just returning the UserIDs, and then using that as a filter for the search again. This seems very inefficient. Can anyone suggest a better method?

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

...your base search...|  stats count by UserID Source_Address | eventstats count as num_sources  by UserID | search num_sources > 2 | table UserID Source_Address

vasanthmss
Motivator

Try this,
|eventstats dc(sourceaddress) as count by userid|search count >2

V
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...