Splunk Search

'Stats count by' set to specific count?

bcjammer03
Explorer

I'm trying to create a query where I get results of a specific user triggering two of the same alerts. Is there a way to set 'stats count by' to equal 2, that results will show only users that have triggered this alert twice?

Or is there a specific command that will allow me to do this?

index=`email` action=blocked | stats count by user_ID

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no specific command for that, but there is a simple combination of commands.

index=`email` action=blocked 
| stats count by user_ID
| where count > 1
---
If this reply helps you, Karma would be appreciated.

bcjammer03
Explorer

yes! thank you @richgalloway 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Small fix as @bcjammer03 asked "triggered twice" you should use "| where count = 2"

richgalloway
SplunkTrust
SplunkTrust

That is a more precise match to the requirements, but I presumed "thrice" is just as interesting as "twice".

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...