Splunk Search

Filter values after timechart

Matthias_BY
Communicator

Hello,

i want to have a search which shows me in 10 minute span how often something did happen. i only want to display the values that are higher then 100.

how can i add this filter after my time chart report?

br
matthias

alt text

Tags (2)
0 Karma
1 Solution

lpolo
Motivator

This is a work around using stats instead of timechart:

index=oidemo sourcetype=access_combined|bucket span=10min _time|stats count by _time clientip|where count>100

It will give you the result set you need.

View solution in original post

lpolo
Motivator

This is a work around using stats instead of timechart:

index=oidemo sourcetype=access_combined|bucket span=10min _time|stats count by _time clientip|where count>100

It will give you the result set you need.

Matthias_BY
Communicator

Great! brilliant - works as expected!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...