Splunk Search

Search query - where after stats count command

shayhibah
Path Finder

I'm trying to count the value of "name" field and to show results only where the count is greater than 1.

My query is: | stats count by name| where count > 1

What am I missing? 😮

Thanks

Tags (1)

martin_mueller
SplunkTrust
SplunkTrust

The search looks correct if you want "count events for each value of the name field, and only show name field values that occur more than once".

If that's not what you're looking for, do elaborate more what your actual use case is.

martin_mueller
SplunkTrust
SplunkTrust

Got a screenshot that includes your search and results with count=1?

0 Karma

shayhibah
Path Finder

Thats exatcly what I want.
The problem is that I can find events on the results that their count equals to 1.

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...