Remove all events of a client based on one or more values of field

[rel82wi]

Hi there

Im trying to filter my search results based on numerical top values of a field.

For example. I have 5k events as customer purchases. I want a list of all customers, who have never paid more than 10.

Or the other way, I want to filter out all customer events of customers, which have a purchase event with a value in a field higher than 10.

Which command could I use?

delete removes the events from the index. I only want to filter my search results.

if i filter for "field<=10" I do only get the events that have purchases, which are smaller than 10, but the list contains customer, which have paid mor than 10 and only removed those specific events.

[rel82wi]

Unfortunately I guess not.

If a customer has an event with purchase >10 I want this customer to be completely filtered out of the result.

Your search I think gives me all maximum prices the customers paid. 

[ITWhisperer · Accepted solution]

Just reverse the inequality from @PickleRick 's solution

<your search> | eventstats max(price) as custmaxprice by user | where custmaxprice < 10

[PickleRick]

Of course. The original post stated "I want a list of customers who never paid more than 10". I can't read 😄

Thx for correcting.

[PickleRick]

Use eventstats to be able to filter events based on stats. For example

<your search> | eventstats max(price) as custmaxprice by user | where custmaxprice>10

 Question is - is this what you want 🙂