I need to count the number objects grouped by a transaction command. The command is: index=* sourcetype="pan:*" | transaction src_ip maxspan=2min | table src_ip, app I need to provide a count for "app" and then limit the results to only those groups with more than 5 apps returned within the time frame. Thank you, Mike ... View more