Threshold stats count table

[hartfoml]

I want to use stats count with several fields and am running my search every hour

I don't want to show any results unless the total count is greater than 50

I had this eventtype=foo | stats count | where count > 50

I what to do this eventtype=foo | stats count by field1 field2 field3 | where Total_Count > 50

I could use "accum" but this will most often only give me the last line and I want all lines if the total of all lines are above 50

I tried eventtype=foo | streamstats count | where count > 50 | stats count by field1 field2 field3 but this did not work

[alacercogitatus · Accepted solution]

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats

[hartfoml]

this worked thanks much