Splunk Search

stats values

Path Finder

Hi Splunk Team!
i have a query: index=mail sourcetype=webmail | stats values(time) as time values(severity) as severity values(email) as email values(status) by session_ID
Results as shown in a picture
i want to show result of values (severity) greater than 2 values?
how can i do it?
Thanks!

0 Karma

Legend

Hi @vumanhtai,
let me understand, do you want to have session_IDs where:

  • there's a severity value greater than 2,
  • there are more than 2 different severity values?

In the first case, try this:

index=mail sourcetype=webmail 
| stats values(time) as time maxs(severity) as severity values(email) as email values(status) by session_ID
| where severity>2

In the second case, try this:

index=mail sourcetype=webmail 
| stats values(time) as time values(severity) as severity dc(severity) as dc_severity values(email) as email values(status) by session_ID
| where dc_severity>2

Ciao.
Giuseppe

0 Karma

Path Finder

thank you
kamlesh_vaghela's answer helped me solve this problem

0 Karma

SplunkTrust
SplunkTrust

@vumanhtai

Are you looking for this?

YOUR_SEARCH | where mvcount(severity) > 2
0 Karma

Path Finder

Thank you so much!

0 Karma

SplunkTrust
SplunkTrust

@vumanhtai

Glad to help you. Please accept this answer to close this question.

0 Karma