Chart - show rows only where one field is greater than zero

[robertlabrie]

Hi,

I'm building a chart of customers and what operating system they're using:

chart count(_raw) by customer,ua_platform | sort ua_platform - "WinXP"

ua_platform can be "WinXP","Win7","MacOSX", etc...

I'm sorting that chart by WinXP descending. I want to limit results to only those customers where the count of WInXP is > 0. Basically I need to report on all our customers using XP, but if they're using other platforms, I need that data too (so I can't just search for ua_platform=WinXP and then where > 0). Any suggestions?

Thanks,
Rob

[somesoni2 · Accepted solution]

Try this

your base search | chart count(_raw) by customer,ua_platform | fillnull value=0 | sort ua_platform - "WinXP" | where WinXP > 0

[robertlabrie]

Worked exactly as described. Thanks!