Splunk Search

Only show Count > X in Timechart

wbordeau
Explorer

I want to hide peaks in timechart that do not exceed a certain threshold. I'm trying the below query but am not having much success.

earliest=-7d@d latest=now sourcetype="squid" clientip=x.x.x.x | bucket_time span=1h | timechart span=30m count by clientip usenull=f useother=f where count>18000

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

Try doing everything up to your timechart command, including its arguments, but instead of the "where", add the where as a separate search command, like this: | where count > 18000. The result set that timechart creates (you can view it as a table, if you wish) is then filtered to consider only certain events. Note that this may leave gaps in the data set....

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...