Splunk Search

Increase count of events but no field results show up

superstarmd
New Member

When searching with this sample query, results show up like below

index=abc sourcetype=def 1.1.1.1

For example, field1 has the following values:

alt text

field2:
alt text

Since each IP needs to be displayed, I wrote this query:

|eval temp=split(field1,",+") | eval IP1=mvindex(temp,0) | eval IP2=mvindex(temp,1) | eval IP3=mvindex(temp,2)

But there's also a requirement to search for total events >= 1000 and still able to display the 3 IPs in a table along with values(field2). When I use count >= 5, results are displayed, but when I use count >= 1000, the results are not. For example: below is expected result

_time   IP1 IP2 IP3 field2
4/8/2019 23:16  1.1.1.1 2.3.4.5 6.7.8.9 /ccss/custom/etc    
                                                     /ccss/custom/etc1
4/8/2019 23:16  1.1.1.1 2.3.4.5 6.7.8.10    /ccss/custom/etc      
                                                    /ccss/custom/etc2
4/8/2019 23:16  1.1.1.1 2.3.4.5 6.7.8.11     /ccss/custom/etc      
                                                   /ccss/custom/etc3

This is my query so far:

index=abc sourcetype=def 1.1.1.1 
   |eval temp=split(field1,",+") | eval IP1=mvindex(temp,0) | eval IP2=mvindex(temp,1) | eval IP3=mvindex(temp,2)
 | stats values(field2) as field2 count(field1) as event_count by IP1 IP2 IP3 _time | where event_count >=1000
Tags (2)
0 Karma

woodcock
Esteemed Legend

You may not be aware that all the *stats commands and functions are multivalue-aware/safe, so try this:

index=abc sourcetype=def 1.1.1.1 
|eval IP=split(field1,",+")
| stats values(field2) AS field2 count(field1) AS event_count BY IP _time
| where event_count >=1000

I am skeptical that you need the _time there, but I am trusting you on that part. Perhaps this is more what you need?

index=abc sourcetype=def 1.1.1.1 
|eval IP=split(field1,",+")
| stats count AS event_count BY IP field1
| stats list(*) AS * sum(event_count) AS total_event_count BY IP
| where total_event_count >=1000
0 Karma

superstarmd
New Member

I still got the "No results found." message even though there are more than 1000 events found..When I lowered it to 5 I got some results.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...