Hi there
Im trying to filter my search results based on numerical top values of a field.
For example. I have 5k events as customer purchases. I want a list of all customers, who have never paid more than 10.
Or the other way, I want to filter out all customer events of customers, which have a purchase event with a value in a field higher than 10.
Which command could I use?
delete removes the events from the index. I only want to filter my search results.
if i filter for "field<=10" I do only get the events that have purchases, which are smaller than 10, but the list contains customer, which have paid mor than 10 and only removed those specific events.
Just reverse the inequality from @PickleRick 's solution
<your search> | eventstats max(price) as custmaxprice by user | where custmaxprice < 10
Unfortunately I guess not.
If a customer has an event with purchase >10 I want this customer to be completely filtered out of the result.
Your search I think gives me all maximum prices the customers paid.
Just reverse the inequality from @PickleRick 's solution
<your search> | eventstats max(price) as custmaxprice by user | where custmaxprice < 10
Of course. The original post stated "I want a list of customers who never paid more than 10". I can't read 😄
Thx for correcting.
Use eventstats to be able to filter events based on stats. For example
<your search> | eventstats max(price) as custmaxprice by user | where custmaxprice>10
Question is - is this what you want 🙂