I am creating a chart using bucket command ( span 4 )
How can I add the last bucket that count all remaining values >16?
Thanks for support
Try like this (adding the eval before your bucket command)
your base search | eval someHourField=if(someHourField >=16,">16",someHourField ) | bucket span=4 someHourField | ..rest of the search...
View solution in original post