Filter Stats Results with where Command

Quick Answer

Filtering on a field that stats itself creates, like count, has to happen after the aggregation has already run, because that field doesn't exist in the raw events at all, it's generated by the stats command as part of building its summary table. This is exactly why where count>100 belongs after stats count by status: the where command evaluates a condition against the fields present in the current result set, and by the time it runs in this pipeline, count is already a field on each row, one row per status code, that where can compare against 100. Placing the filter before stats wouldn't work, since count wouldn't exist yet at that point in the search. The where command is Splunk's general-purpose tool for this kind of post-aggregation filtering, distinct from the search command, which filters raw events before or independent of any transforming command. Any time a question describes wanting to keep only the aggregated rows that meet some numeric or comparison threshold, such as a count, sum, or average above or below a certain value, after a stats, chart, or timechart command has already run, that's the signal to reach for where placed immediately after the aggregating command in the pipeline.