The search produces a table with 4 rows, 2 columns with URI and p95 fields so after the stats, so this | transpose header_field=URI | where URI4>2 ... View more