Splunk Search

Filter the number of less than 1000 of the data

RICKZHANG
Engager

Filter the number of less than 1000 of the data

example:

index=app sourcetype=EPC*Event* level=ERROR |rex field=requestUrl  mode=sed "s/\\d|\d\|%\/|\$amps;\/|\)\/|\(\/|%|\$|\d|\(|\)/@/g"|stats count as Counts by eventId,eventName,level,sourcetype,requestUrl|sort -Counts| head 30|rename sourcetype As Sourcetype,eventId As Eventcode,eventName as Description|fields Sourcetype,Eventcode,Counts,Description,requestUrl

how to filter the number of Counts less than 1000 of the data?
Thanks!

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this is what you are looking for?

index=app sourcetype=EPC*Event* level=ERROR |rex field=requestUrl  mode=sed "s/\\d|\d\|%\/|\$amps;\/|\)\/|\(\/|%|\$|\d|\(|\)/@/g"|stats count as Counts by eventId,eventName,level,sourcetype,requestUrl|sort -Counts| where Counts >= 1000 | head 30|rename sourcetype As Sourcetype,eventId As Eventcode,eventName as Description|fields Sourcetype,Eventcode,Counts,Description,requestUrl
---
If this reply helps you, Karma would be appreciated.
0 Karma

PPape
Contributor

you could use the where clause

index=app sourcetype=EPC*Event* level=ERROR |rex field=requestUrl mode=sed "s/\\d|\d\|%\/|\$amps;\/|)\/|(\/|%|\$|\d|(|)/@/g"|stats count as Counts by eventId,eventName,level,sourcetype,requestUrl|sort -Counts| head 30|rename sourcetype As Sourcetype,eventId As Eventcode,eventName as Description|fields Sourcetype,Eventcode,Counts,Description,requestUr | where Counts < 1000
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...