Splunk Search
Highlighted

Problem with using stats for a count, and also to pull additional data

Path Finder

So, I am going through windows logs, and have output that works for me with something like:

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) by host_machine

But I only want to have hast_machines, where there are more than 5 events. I don't care if there is 1 or 100 'Account' values.

I had attempted to do a subsearch, but something went sideways on that one. Anyone do something like this in the past?

0 Karma
Highlighted

Re: Problem with using stats for a count, and also to pull additional data

SplunkTrust
SplunkTrust

Give this a try

index=windows sourcetype="WinLog" EventCode=XXXX | stats values(Account) count by host_machine | where count>5 | fields - count

View solution in original post