My logs are showing on splunk like given below -
INFO [main] 05-21 10:00:53 Fetching 0 messages. Total 0 messages. (Reading.java:270)
You want to place the where clause after your stats count. Like so:
eventtype="email_fetching" Fetching | stats count | where count>80
Hope this helps
Hello! Put the where clause after the count.
eventtype="email_fetching" Fetching| stats count as totalcount | where totalcount>80