Splunk Search

Problem with using stats for a count, and also to pull additional data

stakor
Path Finder

So, I am going through windows logs, and have output that works for me with something like:

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) by host_machine

But I only want to have hast_machines, where there are more than 5 events. I don't care if there is 1 or 100 'Account' values.

I had attempted to do a subsearch, but something went sideways on that one. Anyone do something like this in the past?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) count by host_machine | where count>5 | fields - count

View solution in original post

somesoni2
Revered Legend

Give this a try

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) count by host_machine | where count>5 | fields - count
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...