Filter the number of less than 1000 of the data

[RICKZHANG]

Filter the number of less than 1000 of the data

example:

index=app sourcetype=EPC*Event* level=ERROR |rex field=requestUrl  mode=sed "s/\\d|\d\|%\/|\$amps;\/|\)\/|\(\/|%|\$|\d|\(|\)/@/g"|stats count as Counts by eventId,eventName,level,sourcetype,requestUrl|sort -Counts| head 30|rename sourcetype As Sourcetype,eventId As Eventcode,eventName as Description|fields Sourcetype,Eventcode,Counts,Description,requestUrl

how to filter the number of Counts less than 1000 of the data?
Thanks!

[richgalloway]

Perhaps this is what you are looking for?

index=app sourcetype=EPC*Event* level=ERROR |rex field=requestUrl  mode=sed "s/\\d|\d\|%\/|\$amps;\/|\)\/|\(\/|%|\$|\d|\(|\)/@/g"|stats count as Counts by eventId,eventName,level,sourcetype,requestUrl|sort -Counts| where Counts >= 1000 | head 30|rename sourcetype As Sourcetype,eventId As Eventcode,eventName as Description|fields Sourcetype,Eventcode,Counts,Description,requestUrl

[PPape]

you could use the where clause

index=app sourcetype=EPC*Event* level=ERROR |rex field=requestUrl mode=sed "s/\\d|\d\|%\/|\$amps;\/|)\/|(\/|%|\$|\d|(|)/@/g"|stats count as Counts by eventId,eventName,level,sourcetype,requestUrl|sort -Counts| head 30|rename sourcetype As Sourcetype,eventId As Eventcode,eventName as Description|fields Sourcetype,Eventcode,Counts,Description,requestUr | where Counts < 1000