https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/555016#M157525 <P>its working now! Appreciate!</P> Wed, 09 Jun 2021 05:45:33 GMT avikc100 2021-06-09T05:45:33Z https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/554998#M157519 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screen Shot 2021-06-08 at 8.57.22 PM.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14549i3756F053B01A49D2/image-size/large?v=v2&amp;px=999" role="button" title="Screen Shot 2021-06-08 at 8.57.22 PM.png" alt="Screen Shot 2021-06-08 at 8.57.22 PM.png" /></span></P><P>&nbsp;</P><P>Am getting data in this format now.<BR />but i need to show only those row where sum of all column values are &gt; 500<BR /><BR />am trying somethign like this. am new so unable to form the query, please help<BR /><BR /></P><DIV class=""><STRONG>index=b2b_wm_core &nbsp;sourcetype=wm_woheaderdetail_log logType="header" type="proc" woCountInFile | bin woCountInFile span=10.1 |&nbsp;</STRONG></DIV><DIV class=""><STRONG>search if(count(woCountInFile &lt; 70) &gt; 500) | timechart &nbsp;span=1h &nbsp;count by woCountInFile</STRONG></DIV> Wed, 09 Jun 2021 04:02:40 GMT https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/554998#M157519 avikc100 2021-06-09T04:02:40Z https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/555009#M157524 <P>If the existing columns are what you initial expect before your &gt;500 test, then simply add the following to the end of your query</P><LI-CODE lang="markup">| addtotals | where Total&gt;500 | fields - Total</LI-CODE><P>&nbsp;</P> Wed, 09 Jun 2021 05:20:47 GMT https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/555009#M157524 bowesmana 2021-06-09T05:20:47Z https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/555016#M157525 <P>its working now! Appreciate!</P> Wed, 09 Jun 2021 05:45:33 GMT https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/555016#M157525 avikc100 2021-06-09T05:45:33Z https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/555044#M157535 <P>If it works for you, please mark the question as solved, so others can benefit</P> Wed, 09 Jun 2021 08:31:53 GMT https://community.splunk.com/t5/Splunk-Search/need-search-with-if-condition/m-p/555044#M157535 bowesmana 2021-06-09T08:31:53Z