Hi,
I have the below SPL which gets the count of each value of the field named "subject". I want to be able to select the values whose count is greater than 5. For example, if the search below returned 10 results, but only 2 had a count greater than 5, how can I pick those two values out and store them in new fields that i can reference after.
index=email_log RejType="Virus Signature Detection" | stats count by subject
Thanks!
So you want to filter to only the subjects that have a count greater than 5?
index=email_log RejType="Virus Signature Detection"
| stats count by subject
| where count>5
Actually there was no need for me to store the values in a new field. Thanks
So you want to filter to only the subjects that have a count greater than 5?
index=email_log RejType="Virus Signature Detection"
| stats count by subject
| where count>5
@ezmo1982 , Above search should give you first half or your requirement (filtering fields values whose count>5). For 2nd requirement (saving to a new field), please provide more information on what you intend to do with these values.