Splunk Search

Is there a way to ignore single events in (transaction)?

albyva
Communicator

I'm using (transaction) to count the number of events in a stream of data.
There are numerous single events, but I'm only interested in events that are 2 or more.
Using the string maxevent=X, I can limit the maximum number of events within a given time span,
but can you ignore a number of events less than a given number (ie: minevents=2)???

index=generic | transaction data maxevents=2 maxspan=2m

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Any transaction command adds fields like duration and eventcount. You can filter based on field eventcount.

index=generic | transaction data maxspan=2m | where eventcount > 1

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Any transaction command adds fields like duration and eventcount. You can filter based on field eventcount.

index=generic | transaction data maxspan=2m | where eventcount > 1

albyva
Communicator

Good idea. Thanks. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...