02 Oct 2024 05:51 PM
Hello everyone, could you help me because I am stuck, through a DQL query I get the following fields based on aggregations, the last thing I need is to be able to filter and only present the fields whose numeric value is greater than a threshold that I define. Example >10, in the case of the image only one value will be presented. I appreciate the help.
02 Oct 2024 06:34 PM
You can use the filterOut command after you do your aggregations to get rid of the records that are < 10.
| summarize count = count(), by:{installerVersion}
| filterOut count < 10
02 Oct 2024 06:44 PM
I appreciate the response, however it seems to me that it does not satisfy the query, as seen in the image the final data is presented as fields with their respective value, of these I seek to present only those that meet the criteria, I have tried "fieldsremove" but I cannot add a condition to delete or not the field.
02 Oct 2024 06:52 PM
I see, you only want to remove the field and not the record. I'm not sure that's possible with the fieldsRemove command as it doesn't seem to take if statements. You may be able to use the countIf function if your summarize command to accomplish this, but I'm not exactly sure how your query is setup.