I'm trying to list all hosts that breach a set threshold average on CPU load. Here is my query which returns no results:
index=sandbox sourcetype="Perfmon:CPU Load"|stats avg(Value) as AVGValue |where AVGValue > 0 | stats count by host
If I remove the |stats avg(Value) as AVGValue | and simply do |where Value > 0 | stats count by host I'm able to get results.
