How do you use an aggregated value as a filter?

[ygaluzo]

Hello,

I need to use an aggregated value as a filter.

The search returns multiple rows, and I need only those with count > 30.

index=*production*  ERROR AND NOT DEBUG | eval svc=mvindex(split(index,"-"),4) | eventstats count as TOTAL_COUNT | stats latest(TOTAL_COUNT) as TC count by svc

Please kept.

Thank you

[kamlesh_vaghela]

@ygaluzo

Can you please try this?

index=*production* ERROR AND NOT DEBUG 
| eval svc=mvindex(split(index,"-"),4) 
| stats count as TC count by svc  | where TC > 30