https://community.splunk.com/t5/Splunk-Search/Filter-values-after-timechart/m-p/187891#M54153 <P>Hello,</P> <P>i want to have a search which shows me in 10 minute span how often something did happen. i only want to display the values that are higher then 100.</P> <P>how can i add this filter after my time chart report?</P> <P>br<BR /> matthias</P> <P><IMG src="http://answers.splunk.com//storage/Bildschirmfoto_2014-03-14_um_11.23.14.png" alt="alt text" /></P> Fri, 14 Mar 2014 10:27:02 GMT Matthias_BY 2014-03-14T10:27:02Z https://community.splunk.com/t5/Splunk-Search/Filter-values-after-timechart/m-p/187891#M54153 <P>Hello,</P> <P>i want to have a search which shows me in 10 minute span how often something did happen. i only want to display the values that are higher then 100.</P> <P>how can i add this filter after my time chart report?</P> <P>br<BR /> matthias</P> <P><IMG src="http://answers.splunk.com//storage/Bildschirmfoto_2014-03-14_um_11.23.14.png" alt="alt text" /></P> Fri, 14 Mar 2014 10:27:02 GMT https://community.splunk.com/t5/Splunk-Search/Filter-values-after-timechart/m-p/187891#M54153 Matthias_BY 2014-03-14T10:27:02Z https://community.splunk.com/t5/Splunk-Search/Filter-values-after-timechart/m-p/187892#M54154 <P>This is a work around using stats instead of timechart:</P> <PRE><CODE>index=oidemo sourcetype=access_combined|bucket span=10min _time|stats count by _time clientip|where count&gt;100 </CODE></PRE> <P>It will give you the result set you need.</P> Fri, 14 Mar 2014 13:22:30 GMT https://community.splunk.com/t5/Splunk-Search/Filter-values-after-timechart/m-p/187892#M54154 lpolo 2014-03-14T13:22:30Z https://community.splunk.com/t5/Splunk-Search/Filter-values-after-timechart/m-p/187893#M54155 <P>Great! brilliant - works as expected!</P> Fri, 14 Mar 2014 14:22:50 GMT https://community.splunk.com/t5/Splunk-Search/Filter-values-after-timechart/m-p/187893#M54155 Matthias_BY 2014-03-14T14:22:50Z