Using "bucket" command, how to add the last bucket that counts all remaining values?

[andrewpagans]

I am creating a chart using bucket command ( span 4 )
How can I add the last bucket that count all remaining values >16?

Thanks for support

[somesoni2 · Accepted solution]

Try like this (adding the eval before your bucket command)

your base search | eval someHourField=if(someHourField >=16,">16",someHourField ) | bucket span=4 someHourField | ..rest of the search...