Filter values after timechart

[Matthias_BY]

Hello,

i want to have a search which shows me in 10 minute span how often something did happen. i only want to display the values that are higher then 100.

how can i add this filter after my time chart report?

br
matthias

[lpolo · Accepted solution]

This is a work around using stats instead of timechart:

index=oidemo sourcetype=access_combined|bucket span=10min _time|stats count by _time clientip|where count>100

It will give you the result set you need.

[Matthias_BY]

Great! brilliant - works as expected!