EventID = “ok”
| timechart span=1h count(EventID) by Login
Every hour I need to display only those values, where count(EventID)>5
I have used filter command (where) after timechart command but it didnt worked.
Please help me!
Thanks in advance!
↧