Splunk Search

How to create search to return rows in table based on count?

johnsasikumar
Path Finder

I have a splunk query that forms table like this

Time    Type    Msg
10/1/2019 0:00  1   xyz
10/2/2019 0:00  2   xyz
10/3/2019 0:00  3   xyz
10/4/2019 0:00  4   xyz
10/5/2019 0:00  1   xyz
10/6/2019 0:00  1   xyz
10/7/2019 0:00  2   xyz
10/8/2019 0:00  2   xyz
10/9/2019 0:00  3   xyz
10/10/2019 0:00 3   xyz
10/11/2019 0:00 4   xyz
10/12/2019 0:00 3   xyz

How do i retain only the rows in the table where the count(type) is <3. So in this case i want the rows with type 4 to be removed because the count of events is less than 3.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @johnsansikumar,
Please append below query after your existing query. (If you want to keep Type which has count less than 3, change where condition otherwise)

| eventstats count by Type | where count<3

Hope this helps!!

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...