Splunk Search

Query results based on stats

mmletzko
Path Finder

I would like to produce results from a query of syslog, based on the number of events using "stats", but show the results in the console, and not the "counts".

For example, the statement "dual | stats count by host | where count > 50" gives me a list of any device with greater than 50 hits of the word "dual". In the results window, it shows the list of routers and their counts...which is still useful data, but not what I'm looking for.

I'm looking for the results in the window to be the actual syslog messages...without having to click something else first.

Is this possible? Seems like it should be simple, and I've tried many iterations of commands, but haven't come up with the right way to do it.

Thanks!!

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Sounds like you want ALL the events from the hosts that have 'dual' in their events more than 50 times?

If so, then you can do this with a subsearch, like so:

* [dual | stats count by host | where count > 50 | fields host]

Since in this case the events you want are a subset of the same events you're getting off disk in the subsearch, you can probably use streamstats to kind of paint the 'counts' onto the events themselves and then just filter without ever transforming the rows.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Sounds like you want ALL the events from the hosts that have 'dual' in their events more than 50 times?

If so, then you can do this with a subsearch, like so:

* [dual | stats count by host | where count > 50 | fields host]

Since in this case the events you want are a subset of the same events you're getting off disk in the subsearch, you can probably use streamstats to kind of paint the 'counts' onto the events themselves and then just filter without ever transforming the rows.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...