How to chart by count, but only if the count is over a given number?

[jleppert]

I'm trying to get a graph based on this:

timechart span=1h count by src_ip

However, I only want to display results if the count is over a given number. How can I do this? I tried |where count>100, but not working.

[ramdaspr · Accepted solution]

Thats because your results do not have a field called "count" when you use a "by" clause in timechart and so the filter would give you no results.

The query filter where would work as you expect if you remove the by clause, but since you are splitting them by src_ip you dont have an option to filter them further.

The only option is to use stats command to do the split and filter and then convert into a chart or xyseries to plot a graph again.

|bucket span=1h _time | stats count by _time src_ip | where count >100 | xyseries _time,src_ip,count

[jleppert]

... thanks again!

[jleppert]

Thanks, it works as expected!

[jleppert]

This works well for a bar chart but for a line chart, it does not connect a src-ip count from one hour to the next. Is there a way to do that?

[ramdaspr]

Are you using this query on a dashboard or on the search panel?

If on the search panel, use the formatting option to set Null Value to zero

If on the dashboard, set

<option name="charting.chart.nullValueMode">zero</option>

This will force the chart to connect but dip to zero if a particular hour doesnt have any data.