Splunk Search

If I have 3 months of data, how do I write a search to return repeating values that appear in all 3 months?

thambisetty
SplunkTrust
SplunkTrust

Hi,

I have data like below:

Day month Signature
10 oct trojan
11 oct abc
12 oct efg
10 nov abc
11 nov efg
11 dec efg

I have 3 months of data and I want to check which signature is repeating for those 3 months so that my output will be "efg" since it is there for 3 months.

Please help me on this.

————————————
If this helps, give a like below.
Tags (1)
0 Karma

srinathd
Contributor

try this "stats count by signature | where count >=3"

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...