How to persist fields after group by command?

[kimsej]

I have a query that does a group by, which allows the sum(diff) column to be calculated. 

[search] | stats sum(diff) by X_Request_ID as FinalDiff:

Screen Shot 2022-09-15 at 6.28.02 PM.png

From here, how can I list out only the entries that have a sum(diff) > 1? My attempt looks like:

[search] | stats sum(diff) by X_Request_ID as FinalDiff |where FinalDiff>1

My issue is that after the group by happens, the query seems to forget about the grouped sum and so I cannot compare it to 1. 

[thesplunkmonkey]

Switch the order up a bit and it should work for you.

| stats sum(diff) as FinalDiff by X_Request_ID  |where FinalDiff>1