https://community.splunk.com/t5/Splunk-Search/Filtering-results-by-count-on-one-item/m-p/150052#M42016 <P>Try this</P> <PRE><CODE>index=MyIndex (EventType="X" OR EventType="Y") | stats count as Count by EventType | append [search index=MyIndex EventType="Z" | stats count as Count by EventType | where Count &gt; 1] </CODE></PRE> Sun, 20 Jul 2014 18:58:08 GMT strive 2014-07-20T18:58:08Z https://community.splunk.com/t5/Splunk-Search/Filtering-results-by-count-on-one-item/m-p/150051#M42015 <P>What I am trying to accomplish.<BR /> Search for three items X Y and Z .<BR /> Count the total number of events for each X Y Z .<BR /> Display any results from X or Y and only display Z when the count is above 1.</P> <P>I am having trouble with the last part of this search. I am not sure how to process the count of the Z result and drop results below the count of 1. I have tried several techniques but I have not had any success in putting the searches together.</P> Sun, 20 Jul 2014 18:15:33 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-results-by-count-on-one-item/m-p/150051#M42015 pitshot 2014-07-20T18:15:33Z https://community.splunk.com/t5/Splunk-Search/Filtering-results-by-count-on-one-item/m-p/150052#M42016 <P>Try this</P> <PRE><CODE>index=MyIndex (EventType="X" OR EventType="Y") | stats count as Count by EventType | append [search index=MyIndex EventType="Z" | stats count as Count by EventType | where Count &gt; 1] </CODE></PRE> Sun, 20 Jul 2014 18:58:08 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-results-by-count-on-one-item/m-p/150052#M42016 strive 2014-07-20T18:58:08Z https://community.splunk.com/t5/Splunk-Search/Filtering-results-by-count-on-one-item/m-p/150053#M42017 <P>Perfect, I was making the search into something way to complicated. The append works great Thanks</P> Sun, 20 Jul 2014 19:18:37 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-results-by-count-on-one-item/m-p/150053#M42017 pitshot 2014-07-20T19:18:37Z