Splunk Search

Search based on field value occurances

New Member

I'm trying to define a search that would output only the events that are related to a value of a field that occur at least X number of times.

So for instance, If I have a field named "Username" and a list of 100 events that contain that field. For sake of argument we'll say that there are 10 users that would display as values for the field "username". Lets also say that I have 2 users, "Bob" and "Mike", that show up more than 10 times each. I want a search that would output all events that contained "Bob" and "Mike" as values of "Username" based off the fact that there are more than 10 events for those users.

Tags (3)
0 Karma
1 Solution

Ultra Champion

your base search here | eventstats count by Username | where count>10

Ought to work.

/Kristian

View solution in original post

0 Karma

Ultra Champion

your base search here | eventstats count by Username | where count>10

Ought to work.

/Kristian

View solution in original post

0 Karma

New Member

That works perfectly, and much simpler than I thought it would be. Thanks very much.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!