Splunk Search

Threshold stats count table

hartfoml
Motivator

I want to use stats count with several fields and am running my search every hour

I don't want to show any results unless the total count is greater than 50

I had this eventtype=foo | stats count | where count > 50

I what to do this eventtype=foo | stats count by field1 field2 field3 | where Total_Count > 50

I could use "accum" but this will most often only give me the last line and I want all lines if the total of all lines are above 50

I tried eventtype=foo | streamstats count | where count > 50 | stats count by field1 field2 field3 but this did not work

Tags (3)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Did you try eventstats?

eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats

0 Karma

hartfoml
Motivator

this worked thanks much

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...