https://community.splunk.com/t5/Splunk-Search/How-to-persist-fields-after-group-by-command/m-p/613293#M213142 <P>I have a query that does a group by, which allows the sum(diff) column to be calculated.&nbsp;</P><P>[search] | stats sum(diff) by X_Request_ID as FinalDiff:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screen Shot 2022-09-15 at 6.28.02 PM.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21492i09576A8AAF12E2BC/image-size/medium?v=v2&amp;px=400" role="button" title="Screen Shot 2022-09-15 at 6.28.02 PM.png" alt="Screen Shot 2022-09-15 at 6.28.02 PM.png" /></span></P><P>From here, how can I list out only the entries that have a sum(diff) &gt; 1? My attempt looks like:</P><DIV>[search] | stats sum(diff) by X_Request_ID as FinalDiff |<STRONG>where FinalDiff&gt;1</STRONG></DIV><DIV>&nbsp;</DIV><DIV>My issue is that after the group by happens, the query seems to forget about the grouped sum and so I cannot compare it to 1.&nbsp;</DIV> Thu, 15 Sep 2022 17:53:03 GMT kimsej 2022-09-15T17:53:03Z https://community.splunk.com/t5/Splunk-Search/How-to-persist-fields-after-group-by-command/m-p/613293#M213142 <P>I have a query that does a group by, which allows the sum(diff) column to be calculated.&nbsp;</P><P>[search] | stats sum(diff) by X_Request_ID as FinalDiff:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screen Shot 2022-09-15 at 6.28.02 PM.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21492i09576A8AAF12E2BC/image-size/medium?v=v2&amp;px=400" role="button" title="Screen Shot 2022-09-15 at 6.28.02 PM.png" alt="Screen Shot 2022-09-15 at 6.28.02 PM.png" /></span></P><P>From here, how can I list out only the entries that have a sum(diff) &gt; 1? My attempt looks like:</P><DIV>[search] | stats sum(diff) by X_Request_ID as FinalDiff |<STRONG>where FinalDiff&gt;1</STRONG></DIV><DIV>&nbsp;</DIV><DIV>My issue is that after the group by happens, the query seems to forget about the grouped sum and so I cannot compare it to 1.&nbsp;</DIV> Thu, 15 Sep 2022 17:53:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-persist-fields-after-group-by-command/m-p/613293#M213142 kimsej 2022-09-15T17:53:03Z https://community.splunk.com/t5/Splunk-Search/How-to-persist-fields-after-group-by-command/m-p/613295#M213144 <P><SPAN>Switch the order up a bit and it should work for you.</SPAN></P><P><SPAN>| stats sum(diff) as FinalDiff by X_Request_ID&nbsp; |</SPAN>where FinalDiff&gt;1</P> Thu, 15 Sep 2022 17:58:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-persist-fields-after-group-by-command/m-p/613295#M213144 thesplunkmonkey 2022-09-15T17:58:56Z