need search with if condition

[avikc100]

Am getting data in this format now.
but i need to show only those row where sum of all column values are > 500

am trying somethign like this. am new so unable to form the query, please help

index=b2b_wm_core  sourcetype=wm_woheaderdetail_log logType="header" type="proc" woCountInFile | bin woCountInFile span=10.1 | 

search if(count(woCountInFile < 70) > 500) | timechart  span=1h  count by woCountInFile

[avikc100 · Accepted solution]

its working now! Appreciate!

[bowesmana]

If the existing columns are what you initial expect before your >500 test, then simply add the following to the end of your query

| addtotals
| where Total>500
| fields - Total

[bowesmana]

If it works for you, please mark the question as solved, so others can benefit