I have a search that works perfectly. It lists the number of calls by area code by state. However, I'm trying to limit the results to only display area codes that have 500 or more hits.
Here's my search...
sourcetype="VHT:HPIQ:IVROutput" DNIS "Success" | eval ac=substr(DNIS,2,3) | lookup areacode.csv areacode as ac OUTPUT state | stats count(ac) by state | sort -count(ac)
I've tried using the where command, but I can't seem to get the syntax correct. I'm sure it's a very simple answer but I am only 1 month into my Spunk learning.
Thanks for the help.
@muzicman61,
Try,
sourcetype="VHT:HPIQ:IVROutput" DNIS "Success" | eval ac=substr(DNIS,2,3) | lookup areacode.csv areacode as ac OUTPUT state
| stats count(ac) as ac by state | where ac>=500
@muzicman61,
Try,
sourcetype="VHT:HPIQ:IVROutput" DNIS "Success" | eval ac=substr(DNIS,2,3) | lookup areacode.csv areacode as ac OUTPUT state
| stats count(ac) as ac by state | where ac>=500
Thank you... I was close but it kept giving me errors. I knew the solution would be simple.