Splunk Search

How to write a search to filter and only return results for a field with a count greater than 2?

rgtsplunk
Explorer

It seems that this should be a simple filter, but we cannot seem to find out how to do this in Splunk.

We do a search, returning a UserID and a Source_Address. We would like to show all the source addresses for the given UserID, but only if the number of source addresses for that UserID is greater than 2.

We can use "stats distinct_count(Source_Address) as num_sources BY UserID | search num_sources > 2", but the output of that no longer has the actual Source Addresses for us to show - only the number. The "where" clause does not specify a way of counting by UserID, nor does anything else, it appears.

The only other thing we can see is to do the whole search as a sub-search, just returning the UserIDs, and then using that as a filter for the search again. This seems very inefficient. Can anyone suggest a better method?

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

...your base search...|  stats count by UserID Source_Address | eventstats count as num_sources  by UserID | search num_sources > 2 | table UserID Source_Address

vasanthmss
Motivator

Try this,
|eventstats dc(sourceaddress) as count by userid|search count >2

V
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...