Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Search based on field value occurances

$
0
0

I'm trying to define a search that would output only the events that are related to a value of a field that occur at least X number of times.

So for instance, If I have a field named "Username" and a list of 100 events that contain that field. For sake of argument we'll say that there are 10 users that would display as values for the field "username". Lets also say that I have 2 users, "Bob" and "Mike", that show up more than 10 times each. I want a search that would output all events that contained "Bob" and "Mike" as values of "Username" based off the fact that there are more than 10 events for those users.


Viewing all articles
Browse latest Browse all 13053

Trending Articles