FAQ: How do I use test() to do field evaluations?

Similar to where in Splunk, you can use groupBy() and test() to check one field value against another. In this example, we want to see if a username has completed more than 25 logons in a given search window:

#event_simpleName=UserLogon
| groupBy(UserName, function=(count(aid, as=totalLogons)))
| test(totalLogons > 25)