Only display rows in table if it contains value

[606866581]

Hi Splunkers, I've been struggling to find what should be an easy solution...

I have a table with many columns, one of the headers is: server_load.

I only want to display a row, if server_load > 80.

Any advice is much appreciated, Thanks

[linu1988]

Isn't it easy to just apply where condition server_load>80 in your search query? Am i not getting something!! Kindly explain.

[aholzer · Accepted solution]

Pipe your base search into a where or search command with server_load > 80.

<base search> | where server_load > 80 | table <your fields>

You don't even need the where clause if your server_load is an original field from the events. In which case you can simply add "server_load > 80" as part of your base search.

<base search> server_load > 80 | table <your fields>

[606866581]

Brilliant, I'll note this one down for future use.
Thanks a bunch!