I have a query that does a group by, which allows the sum(diff) column to be calculated.
[search] | stats sum(diff) by X_Request_ID as FinalDiff:
From here, how can I list out only the entries that have a sum(diff) > 1? My attempt looks like:
Switch the order up a bit and it should work for you.
| stats sum(diff) as FinalDiff by X_Request_ID |where FinalDiff>1