Why not this
yourbasesearch (fieldA > 1 AND someCriteriaA) OR (fieldA <= 1 AND someOtherCriteriaB)
Oops - just saw the eventstats
comment. Then do this
yourbasesearch
| eventstats something to get fieldA
| search (fieldA > 1 AND someCriteriaA) OR (fieldA <= 1 AND someOtherCriteriaB)
Why not this
yourbasesearch (fieldA > 1 AND someCriteriaA) OR (fieldA <= 1 AND someOtherCriteriaB)
Oops - just saw the eventstats
comment. Then do this
yourbasesearch
| eventstats something to get fieldA
| search (fieldA > 1 AND someCriteriaA) OR (fieldA <= 1 AND someOtherCriteriaB)