This is my query:
index=mtickets MovieRating=R CustomerAge<17 | stats count by MovieName
Can I restrict the results to those events where the sum(count) > 30 by MovieName?
HI,
did you try to add | where count>=30
?
@jmgilpin
Are you looking for this?
index=mtickets MovieRating=R CustomerAge<17 | stats count by MovieName | where count>30