Splunk Search

Query results based on stats

mmletzko
Path Finder

I would like to produce results from a query of syslog, based on the number of events using "stats", but show the results in the console, and not the "counts".

For example, the statement "dual | stats count by host | where count > 50" gives me a list of any device with greater than 50 hits of the word "dual". In the results window, it shows the list of routers and their counts...which is still useful data, but not what I'm looking for.

I'm looking for the results in the window to be the actual syslog messages...without having to click something else first.

Is this possible? Seems like it should be simple, and I've tried many iterations of commands, but haven't come up with the right way to do it.

Thanks!!

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Sounds like you want ALL the events from the hosts that have 'dual' in their events more than 50 times?

If so, then you can do this with a subsearch, like so:

* [dual | stats count by host | where count > 50 | fields host]

Since in this case the events you want are a subset of the same events you're getting off disk in the subsearch, you can probably use streamstats to kind of paint the 'counts' onto the events themselves and then just filter without ever transforming the rows.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Sounds like you want ALL the events from the hosts that have 'dual' in their events more than 50 times?

If so, then you can do this with a subsearch, like so:

* [dual | stats count by host | where count > 50 | fields host]

Since in this case the events you want are a subset of the same events you're getting off disk in the subsearch, you can probably use streamstats to kind of paint the 'counts' onto the events themselves and then just filter without ever transforming the rows.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...