Splunk: regex – No events counted

I am trying to extract a field after a specific expression using regex and then running a query which counts the events where this condition is met. I did this:

query | rex field=_raw "text: (?<value>d+)" | timechart partial=f span=5m count as numbers | where value > 3

There are some log-entries for which value is greater than 3, but nevertheless this events are not counted. What did I do wrong here and why did I not get a result?

Put your where before your time chart

enter image description here

Using the 8 events, I can select those which are greater than 3

source="splunk.txt" host="stack" index="stack" sourcetype="raw_line_break"
| rex "text: (?<value>d)"
| where value > 3
| timechart partial=f span=5m count as numbers

this returns me a count of 2 since only two events in that time window were greater than 3

enter image description here

Read more here: Source link