Here is my Splunk Query:
index=test "Entry Done for Id=" | rex field=_raw Id=(?<Id>.*?)# | rex field=_raw UserID=(?<UserId>.*?)# | rex field=_raw Amount=(?<Amount>.*?)# | rex field=_raw PercentageAmount=(?<PercentageAmount>.*?)#
| stats list(Id) as "Unique Id" list(UserID) as "User ID" list(Amount) as "Given Amount" list(PercentageAmount) as "Override Amount"
| table "Unique ID" "User ID" "Given Discount" "Override Amount"
I want to filter those records from this table which has
Given Amount>50.00 OR Override Amount>90.00
Note: Given Amount and Override Amount can be in decimal.
Add the below query at the end of your search.
| search "Given Amount">50.00 OR "Override Amount">90.00
If this reply helps you, an upvote/like would be appreciated.