I have the query to find the response code and count vs time (in 1 minute time interval) as below.   index=sample_index path=*/sample_path* | bucket _time span=1m | stats count by _time responseCode   The result shows the response code and count vs time for each minute. But I just need the events in those 1 minutes which have 403 response code along with other response codes and skip which doesn't have 403.  Suppose during time1, if there are only events with response code 200, I don't need that in my result. But during time2, if there are events with response code 200 and 403, I need that in the result as time, response code, count.  ... View more

I have a query to find the maximum event count that has happened in a minute over time as below index="xxx" "headers.a"="abc" | rename "status.operation_path" as PATH | bucket _time span=1m | stats count by PATH _time | stats max(count) by PATH The above query displays the maximum event count in a minute VS PATH.  I also need to display the time when this maximum event count happened for each path.  ... View more

Given below is a snippet of splunk event. My requirement is to find all the occurrences of "isOutstanding": true. Here the point to note is that one event may/may not have multiple occurrences. Need to find the total count from multiple events over a period of time. { \"school\": { \"schoolId\": \"1\", \"schoolName\": \"SchoolX\", \"schoolType\": \"private\", \"students\": [ { \"id\": \"1\", \"isOutstanding\": true, }, { \"id\": \"2\", \"isOutstanding\": false, }, { \"id\": \"3\", \"isOutstanding\": false, } ] } } The below Splunk query index=myIndex "isOutstanding":true gives the count of events having "isOutstanding": true. But it doesn't consider the count of multiple occurrences in one event. How can I get the count of all the occourences in an event? TIA   ... View more