Splunk Search

Problem with using stats for a count, and also to pull additional data

stakor
Path Finder

So, I am going through windows logs, and have output that works for me with something like:

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) by host_machine

But I only want to have hast_machines, where there are more than 5 events. I don't care if there is 1 or 100 'Account' values.

I had attempted to do a subsearch, but something went sideways on that one. Anyone do something like this in the past?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) count by host_machine | where count>5 | fields - count

View solution in original post

somesoni2
Revered Legend

Give this a try

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) count by host_machine | where count>5 | fields - count
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...