I want to use stats count with several fields and am running my search every hour
I don't want to show any results unless the total count is greater than 50
I had this eventtype=foo | stats count | where count > 50
I what to do this eventtype=foo | stats count by field1 field2 field3 | where Total_Count > 50
I could use "accum" but this will most often only give me the last line and I want all lines if the total of all lines are above 50
I tried eventtype=foo | streamstats count | where count > 50 | stats count by field1 field2 field3
but this did not work
Did you try eventstats?
eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats
Did you try eventstats?
eventtype=foo | eventstats count|where count>50|stats count by field1 field2 field3
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eventstats
this worked thanks much