I have a working search string like
host=ABC | rename "H Code" TO HCODE | join HCODE [search host= EFG ] | timechart span=1d sum(Visits) AS Visit, count(USERCOUNT) AS UserCount by HCODE | foreach Visit* [ eval Avg:<<MATCHSTR>> = '<<FIELD>>'/'UserCount<<MATCHSTR>>'] | fields Avg:*
I want to avoid Avg value less than 0.I tried where it is not working.
can anybody help.
here is a run everywhere example how to do this:
index=_internal source=*metrics.log | eventstats avg(kbps) as avg_kbps by series | eval avg:*=avg_kbps | table avg:* | search avg:*>1.5
this will return an table of all values of avg:* higher then 1.5
The query which you have give is working.I think the reason behind is avg:* is fixed field name.In my case field name is dynamic. Avg:<>