Splunk Search

Threshold stats count table

hartfoml
Motivator

I want to use stats count with several fields and am running my search every hour

I don't want to show any results unless the total count is greater than 50

I had this eventtype=foo | stats count | where count > 50

I what to do this eventtype=foo | stats count by field1 field2 field3 | where Total_Count > 50

I could use "accum" but this will most often only give me the last line and I want all lines if the total of all lines are above 50

I tried eventtype=foo | streamstats count | where count > 50 | stats count by field1 field2 field3 but this did not work

Tags (3)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats

0 Karma

hartfoml
Motivator

this worked thanks much

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...