https://community.splunk.com/t5/Getting-Data-In/How-to-filter-results-in-timechart-statistics-table/m-p/376830#M68194 <P>EventID = “ok”<BR /> | timechart span=1h count(EventID) by Login</P> <P>Every hour I need to display only those values, where count(EventID)&gt;5</P> <P>I have used filter command (where) after timechart command but it didnt worked.</P> <P>Please help me!<BR /> Thanks in advance!</P> Fri, 17 May 2019 04:18:54 GMT stevesmith08 2019-05-17T04:18:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-results-in-timechart-statistics-table/m-p/376830#M68194 <P>EventID = “ok”<BR /> | timechart span=1h count(EventID) by Login</P> <P>Every hour I need to display only those values, where count(EventID)&gt;5</P> <P>I have used filter command (where) after timechart command but it didnt worked.</P> <P>Please help me!<BR /> Thanks in advance!</P> Fri, 17 May 2019 04:18:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-results-in-timechart-statistics-table/m-p/376830#M68194 stevesmith08 2019-05-17T04:18:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-results-in-timechart-statistics-table/m-p/376831#M68195 <P>Not a clean solution but this should work</P> <PRE><CODE>EventID="ok" | bin span=1h _time | stats count(EventID) as cnt by Login _time | where cnt &gt; 500 | timechart span=1h sum(cnt) as cnt by Login| fillnull value=0 </CODE></PRE> Fri, 17 May 2019 04:52:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-results-in-timechart-statistics-table/m-p/376831#M68195 nabeel652 2019-05-17T04:52:56Z