Filtering in search string.

[SplunkBaby]

I have a working search string like

host=ABC | rename  "H Code" TO HCODE | join HCODE [search host= EFG  ] | timechart span=1d sum(Visits) AS Visit, count(USERCOUNT) AS UserCount  by HCODE | foreach Visit* [ eval Avg:<<MATCHSTR>> = '<<FIELD>>'/'UserCount<<MATCHSTR>>'] | fields Avg:*

I want to avoid Avg value less than 0.I tried where it is not working.
can anybody help.

[MuS]

Hi,

here is a run everywhere example how to do this:

index=_internal source=*metrics.log | eventstats avg(kbps) as avg_kbps by series | eval avg:*=avg_kbps | table avg:* | search avg:*>1.5

this will return an table of all values of avg:* higher then 1.5

cheers, MuS

[SplunkBaby]

The query which you have give is working.I think the reason behind is avg:* is fixed field name.In my case field name is dynamic. Avg:<>

[MuS]

update ping