Splunk Search

where count is > 5

Contributor

Hi Everyone - I'm trying to reduce noise on some of my reports. Certain messages with "unreadable" are coming in and I only want them on the report if the the count is > 5. At the same time, I don't want to ignore everything else that is < 5 that does not include "unreadable"...

Here's what i thought made sense.
stats dc(MESSAGE) | where MESSAGE="unreadable" > 5

Tags (4)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

I don't quite understand your example, so here's how you would filter events based on your description:

... | where NOT (count <= 5 AND match(MESSAGE, "unreadable"))

That will drop events if the count is less or equal five and the message contains "unreadable".

View solution in original post

SplunkTrust
SplunkTrust

I don't quite understand your example, so here's how you would filter events based on your description:

... | where NOT (count <= 5 AND match(MESSAGE, "unreadable"))

That will drop events if the count is less or equal five and the message contains "unreadable".

View solution in original post

Contributor

nevermind, didn't read peter's post. Thanks everyone.

0 Karma

SplunkTrust
SplunkTrust

All the where needs is the two fields referenced - where they come from doesn't matter.

If you compute them using stats then yes, the stats must be somewhere before the where.

0 Karma

Contributor

Martin, does stats have to be in the query before the '| where'?

0 Karma

SplunkTrust
SplunkTrust

Well, filtering based on message content isn't going to be possible after a stats dc(message) because that just yields a single number.

Explorer

I'd like to point out for the original poster that your method assumes that the stats command is "stats count by MESSAGE" instead of "stats dc(MESSAGE)", which will count the number of times a particular message in MESSAGE is encountered (which I believe is what they want) instead of counting the number of different values that MESSAGE holds (which is in the example, but not necessarily what they are asking for).