Hi Splunk Team!
i have a query: index=mail sourcetype=webmail | stats values(time) as time values(severity) as severity values(email) as email values(status) by session_ID
Results as shown in a picture
i want to show result of values (severity) greater than 2 values?
how can i do it?
Thanks!
Hi @vumanhtai,
let me understand, do you want to have session_IDs where:
In the first case, try this:
index=mail sourcetype=webmail
| stats values(time) as time maxs(severity) as severity values(email) as email values(status) by session_ID
| where severity>2
In the second case, try this:
index=mail sourcetype=webmail
| stats values(time) as time values(severity) as severity dc(severity) as dc_severity values(email) as email values(status) by session_ID
| where dc_severity>2
Ciao.
Giuseppe
thank you
kamlesh_vaghela's answer helped me solve this problem
@vumanhtai
Are you looking for this?
YOUR_SEARCH | where mvcount(severity) > 2
Thank you so much!
@vumanhtai
Glad to help you. Please accept this answer to close this question.