How to exclude values from evaluation ?

[zacksoft]

I have a list of values for trans_time field ranging from 0 to 45000 (not continious values).
I am performing some calculations on it such as average, summation etc...

I only want to perform my eval calculations on values from until 1500. I have sorted the trans_time field. How to set up the condition such as all the follow up evals will only be calculated from 0 to 1500. All the values above should just be excluded.

[elliotproebstel · Accepted solution]

If you want to exclude from your calculations all events where trans_time<=1500, then you can add exactly that to your base search. So, for example, if your base search was index=main sourcetype=some_data, then you would change it to index=main sourcetype=some_data trans_time<=1500. If the trans_time field doesn't appear in your base search and is created by calculations earlier in the search pipeline, then you can add | search trans_time<=1500 after the field is created.

[493669]

have you tried

| sort 1500 -_time

[zacksoft]

It shows the first 1500 items..
and my trans_time values are not continiuos like (1, 2, 3, 4 ..3tc..) they are more like 1, 8, 4, 13, 19 ...)
I just need to make sure that I operate only on values from trans_time field whose value is less than 1500.