https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-to-keep-only-specific-rows/m-p/364214#M169975 <P>Just add:</P> <PRE><CODE>| where type1 &gt; (2 * type2) </CODE></PRE> Thu, 26 Apr 2018 00:45:01 GMT woodcock 2018-04-26T00:45:01Z https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-to-keep-only-specific-rows/m-p/364213#M169974 <P>My query so far looks like this:</P> <P>sourcetype="type1" OR sourcetype="type2" |chart count(sales1) over sales2 by sourcetype </P> <P>How would I pipe in | where ..</P> <P>so that it only keeps rows where the value in type1 is greater than twice the value in type2?</P> Wed, 25 Apr 2018 23:45:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-to-keep-only-specific-rows/m-p/364213#M169974 summitsplunk 2018-04-25T23:45:57Z https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-to-keep-only-specific-rows/m-p/364214#M169975 <P>Just add:</P> <PRE><CODE>| where type1 &gt; (2 * type2) </CODE></PRE> Thu, 26 Apr 2018 00:45:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-to-keep-only-specific-rows/m-p/364214#M169975 woodcock 2018-04-26T00:45:01Z