https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337827#M163261 <P>It shows the first 1500 items.. <BR /> and my trans_time values are not continiuos like (1, 2, 3, 4 ..3tc..) they are more like 1, 8, 4, 13, 19 ...)<BR /> I just need to make sure that I operate only on values from trans_time field whose value is less than 1500.</P> Tue, 29 Sep 2020 17:54:41 GMT zacksoft 2020-09-29T17:54:41Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337825#M163259 <P>I have a list of values for trans_time field ranging from 0 to 45000 (not continious values). <BR /> I am performing some calculations on it such as average, summation etc...<BR /><BR /> I only want to perform my eval calculations on values from until 1500. I have sorted the trans_time field. How to set up the condition such as all the follow up evals will only be calculated from 0 to 1500. All the values above should just be excluded.</P> Tue, 29 Sep 2020 17:52:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337825#M163259 zacksoft 2020-09-29T17:52:01Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337826#M163260 <P>have you tried</P> <PRE><CODE>| sort 1500 -_time </CODE></PRE> Mon, 29 Jan 2018 14:10:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337826#M163260 493669 2018-01-29T14:10:28Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337827#M163261 <P>It shows the first 1500 items.. <BR /> and my trans_time values are not continiuos like (1, 2, 3, 4 ..3tc..) they are more like 1, 8, 4, 13, 19 ...)<BR /> I just need to make sure that I operate only on values from trans_time field whose value is less than 1500.</P> Tue, 29 Sep 2020 17:54:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337827#M163261 zacksoft 2020-09-29T17:54:41Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337828#M163262 <P>If you want to exclude from your calculations all events where <CODE>trans_time&lt;=1500</CODE>, then you can add exactly that to your base search. So, for example, if your base search was <CODE>index=main sourcetype=some_data</CODE>, then you would change it to <CODE>index=main sourcetype=some_data trans_time&lt;=1500</CODE>. If the <CODE>trans_time</CODE> field doesn't appear in your base search and is created by calculations earlier in the search pipeline, then you can add <CODE>| search trans_time&lt;=1500</CODE> after the field is created.</P> Mon, 29 Jan 2018 14:33:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-values-from-evaluation/m-p/337828#M163262 elliotproebstel 2018-01-29T14:33:34Z