Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.
The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.
The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.
|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count
Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.
The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.
The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.
|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count
... thanks again!
Thanks, it works as expected!
This works well for a bar chart but for a line chart, it does not connect a src-ip count from one hour to the next. Is there a way to do that?
Are you using this query on a dashboard or on the search panel?
If on the search panel, use the formatting option to set Null Value to zero
If on the dashboard, set
<option name="charting.chart.nullValueMode">zero</option>
This will force the chart to connect but dip to zero if a particular hour doesnt have any data.