https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177173#M50908 <P>Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.</P> <P>The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.</P> <P>The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.</P> <PRE><CODE>|bucket span=1h _time | stats count by _time src_ip | where count &gt;100 | xyseries _time,src_ip,count </CODE></PRE> Thu, 30 Apr 2015 04:49:45 GMT ramdaspr 2015-04-30T04:49:45Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177172#M50907 <P>I'm trying to get a graph based on this:</P> <PRE><CODE>timechart span=1h count by src_ip </CODE></PRE> <P>However, I only want to display results if the count is over a given number. How can I do this? I tried <CODE>|where count&gt;100</CODE>, but not working.</P> Thu, 30 Apr 2015 03:50:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177172#M50907 jleppert 2015-04-30T03:50:55Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177173#M50908 <P>Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.</P> <P>The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.</P> <P>The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.</P> <PRE><CODE>|bucket span=1h _time | stats count by _time src_ip | where count &gt;100 | xyseries _time,src_ip,count </CODE></PRE> Thu, 30 Apr 2015 04:49:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177173#M50908 ramdaspr 2015-04-30T04:49:45Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177174#M50909 <P>Thanks, it works as expected! </P> Thu, 30 Apr 2015 05:06:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177174#M50909 jleppert 2015-04-30T05:06:20Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177175#M50910 <P>This works well for a bar chart but for a line chart, it does not connect a src-ip count from one hour to the next. Is there a way to do that?</P> Thu, 30 Apr 2015 05:16:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177175#M50910 jleppert 2015-04-30T05:16:10Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177176#M50911 <P>Are you using this query on a dashboard or on the search panel?</P> <P>If on the search panel, use the formatting option to set Null Value to zero</P> <P>If on the dashboard, set </P> <PRE><CODE>&lt;option name="charting.chart.nullValueMode"&gt;zero&lt;/option&gt; </CODE></PRE> <P>This will force the chart to connect but dip to zero if a particular hour doesnt have any data.</P> Thu, 30 Apr 2015 07:27:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177176#M50911 ramdaspr 2015-04-30T07:27:13Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177177#M50912 <P>... thanks again!</P> Thu, 30 Apr 2015 09:48:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-by-count-but-only-if-the-count-is-over-a-given/m-p/177177#M50912 jleppert 2015-04-30T09:48:07Z