https://community.splunk.com/t5/Splunk-Search/The-quot-where-count-quot-clause-is-showing-no-results/m-p/700916#M237789 <P>I removed "(actor.displayName)" from the first "count" command and it works now.</P> Thu, 03 Oct 2024 16:03:52 GMT anayi 2024-10-03T16:03:52Z https://community.splunk.com/t5/Splunk-Search/The-quot-where-count-quot-clause-is-showing-no-results/m-p/700911#M237788 <P>I'm trying to create an alert. The alert's query ends with " | stats values(*) as * by actor.displayName | stats count(actor.displayName)".</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="anayi_0-1727969909088.png" style="width: 771px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32928iA90A55110D482AE8/image-dimensions/771x41?v=v2" width="771" height="41" role="button" title="anayi_0-1727969909088.png" alt="anayi_0-1727969909088.png" /></span></P><P>I want to add the clause, " | where count &gt; 5" at the end of the query. To verify that the query would work, I changed it "| where count &lt; 5", but I'm getting no results.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="anayi_1-1727970089613.png" style="width: 768px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32929i6C43C51381B8F71A/image-dimensions/768x167?v=v2" width="768" height="167" role="button" title="anayi_1-1727970089613.png" alt="anayi_1-1727970089613.png" /></span></P><P>&nbsp;</P> Thu, 03 Oct 2024 15:44:46 GMT https://community.splunk.com/t5/Splunk-Search/The-quot-where-count-quot-clause-is-showing-no-results/m-p/700911#M237788 anayi 2024-10-03T15:44:46Z https://community.splunk.com/t5/Splunk-Search/The-quot-where-count-quot-clause-is-showing-no-results/m-p/700916#M237789 <P>I removed "(actor.displayName)" from the first "count" command and it works now.</P> Thu, 03 Oct 2024 16:03:52 GMT https://community.splunk.com/t5/Splunk-Search/The-quot-where-count-quot-clause-is-showing-no-results/m-p/700916#M237789 anayi 2024-10-03T16:03:52Z https://community.splunk.com/t5/Splunk-Search/The-quot-where-count-quot-clause-is-showing-no-results/m-p/700920#M237791 <LI-CODE lang="markup">| stats count(actor.displayName)</LI-CODE><P>will give you a field called "count(actor.displayName)" not "count" which is why the where command returns no results. Try it like this</P><LI-CODE lang="markup">| stats count(actor.displayName) as count | where count &lt; 5</LI-CODE> Thu, 03 Oct 2024 16:25:28 GMT https://community.splunk.com/t5/Splunk-Search/The-quot-where-count-quot-clause-is-showing-no-results/m-p/700920#M237791 ITWhisperer 2024-10-03T16:25:28Z