Splunk Search

how to stats counts if one of the field's value greater than 100 ?

corehan
Explorer

Hello,

I have ALERT field and in this field has different types ALERT values, so i want filter one of them counts if greater than 100

ALERT="LINK-3-UPDOWN" count=500
ALARM="IFNET/1/CRCERRORRISING" count =20

So I tried this but only show ALERT="LINK-3-UPDOWN" . I want see all values but "LINK-3-UPDOWN" filtered count

|stats count by DATE,Region,managed_object,ALERT |where count>100 AND ALARM="LINK-3-UPDOWN" |sort -count -ALARM

Regards,

0 Karma

PavelP
Motivator

Hello @corehan,

if I understand it correctly, the problem is that the count field from the raw event get overwritten by count field generated by stats command.

.. | rex "count=(?<count_orig>\d+)" |stats count by DATE,Region,managed_object,ALERT |where count_orig >100 AND ALARM="LINK-3-UPDOWN" |sort -count -ALARM

alternatively (not tested):

|stats count AS amount by DATE,Region,managed_object,ALERT |where count>100 AND ALARM="LINK-3-UPDOWN" |sort -amount -ALARM
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@corehan
Can you please share some sample events and expected output?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...