Splunk Search

Threshold stats count table

hartfoml
Motivator

I want to use stats count with several fields and am running my search every hour

I don't want to show any results unless the total count is greater than 50

I had this eventtype=foo | stats count | where count > 50

I what to do this eventtype=foo | stats count by field1 field2 field3 | where Total_Count > 50

I could use "accum" but this will most often only give me the last line and I want all lines if the total of all lines are above 50

I tried eventtype=foo | streamstats count | where count > 50 | stats count by field1 field2 field3 but this did not work

Tags (3)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats

0 Karma

hartfoml
Motivator

this worked thanks much

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...