I'm using the following query over 24hrs.
| initial search
| timechart useother=f span=1h avg(field1) by field2 where avg > 100
| fields - NULL
And I get results for that meet that criteria, but when I increase the numeric value from > 100 to > 400, I get zero results even though I should see at least one or two fields from "field2" populate. Any thoughts on what is causing my dilemma?