UDM Search Returning $event_count > 3

[Fr4n2pirit]

Not sure why I am having such a difficult time trying to figure this out, but if I'm running a particular UDM Search and I want to set the results to return values greater than a minimum number (say 3), how would you go about this? 

Example: Return results when $event_count > 3

metadata.vendor_name = "Okta" nocase 
metadata.product_event_type = "user.authentication.auth_via_richclient"
principal.user.userid = $userId

match:
  $userId 

outcome:
  $event_count = count($userId) 
  $application = array_distinct(target.application)
  $summary = array_distinct(security_result[0].summary)
  $user_ip = array_distinct(principal.asset.ip[0])
  $threat_result = array_distinct(security_result[0].action[0])

order: $event_count desc

[AymanC]

Hi @Fr4n2pirit 

It appears you are trying to do a statistics and aggregates search. Within this search there is no “condition” like capabilities. Therefore for this use case you could create a variable and  do a “count_distinct” based on metadata.id and then order the variable descending, ensuring your matching over a value.