Help with a simple search: How do I count how many days match a certain criteria? (example below)

[dritjon]

I have this search which builds a table

my_search | timechart span=1d sum(eval(b/1024/1024/1024)) AS volume_b

it will build a table like this:

24 October	18
25 October	10
26 October	25
27 October	30

Now, from this search I want to do a simple count: how many days have a volume>15

for the table above it would just show count: 3

[gcusello · Accepted solution]

Hi @dritjon,

you have to add a condition and stats count to your search:

my_search 
| timechart span=1d sum(eval(b/1024/1024/1024)) AS volume_b
| where volume_b>15
| stats count

Ciao.

Giuseppe