Search query for count of max response time of pages greater than xx

[subhadipc]

I have a search query that reads as follows:

.....| eval time_sec = round(time_taken/1000)
| chart max(time_sec) as max_response_time by cs_uri_stem
| where max_response_time > xx

where .... gives a list of pages and sources, and xx is the time in figures. The search is programmed to take the last 7 day data (i.e., uses -7d).

The output gives the pages where the max_response_time is greater than xx. It does not state how many times did the max_response_time cross xx. How can I tune the search query so that it gives me a count of how many times did the max response time of the page cross xx. Please note, the output should only list the pages whose max response time crossed xx at least once, and the remaining pages be ignored.

[Damien_Dallimor]

Try something like :

...| eval time_sec = round(time_taken/1000) | where time_sec > xx | stats count by cs_uri_stem