Hi,
I have a search ending like this :
| chart count over service by environment
| where prod>50 OR OR dev>50
It returns me a table :
| service | prod | dev |
| AAA | 16 | 110 |
| BBB | 225 | 0 |
The problem is that I want to mask the 16 and 0 results and keep only results above 50.
How can I do that ?
Thanks !
Hi @mah,
at the end of your search try to put:
| eval prod=if(prod<50,"",prod), dev=(if(dev<50,"",dev)Ciao.
Giuseppe
Hi @mah,
at the end of your search try to put:
| eval prod=if(prod<50,"",prod), dev=(if(dev<50,"",dev)Ciao.
Giuseppe
Yes it works !
Thanks !