index=rhwindows sourcetype="WinEventLog:System" Type=Error OR Type=Warning NOT (*PrintSpooler OR *SpoolerWin32SPL) earliest=-24h@h latest=now | chart count over host by SourceName
Hopefully simple one: Given the search above how do I only display counts that are greater then one for SourceName of a host.
Thanks.