# Kibana advanced search split by

**URL:** <https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473>\
**Category:** Kibana\
**Created:** [June 30, 2021, 2:42pm UTC](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473 "2021-06-30T14:42:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex112345](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex112345/32/91016_2.png) [@Alex112345](https://discuss.elastic.co/u/Alex112345)\
**Post date:** [June 30, 2021, 2:42pm UTC](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473/1 "2021-06-30T14:42:18Z")

</div>

Hi all,

I'm quite new to Elastic & Kibana. I've used Splunk in the past and I was wondering if someone could point me in the right direction to do something as below  
Let's say we have an indexed field called users. There are 1000+ users.  
There is another field called response; which can be anywhere from 0 to 999;

Would it be possible to create a graph/table which only shows the users that have a percentage for a specific response over value X?  
i.e  
We have user no 1234;  
In the last day, the response percentages for that user is as below  
1- 90%  
2- 5%  
9-4%  
10-1%

Would it be possible to create a table/visualisation that will show that user if it exceeds the threshold of response 1 to be over 80% ? If that's the case, would it be possible to create such table, that would be split by users and to show that type of data for all the available users?

If such thing is not possible using a visualisation, would it be possible to do it using a watcher?

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 1, 2021, 1:52am UTC](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473/2 "2021-07-01T01:52:16Z")

</div>

Welcome to our community! 😃

You can do this in Kibana for sure. Start with the base visualisation of users and response, and then add a filter for response \> 80.

---

<div class="post-metadata">

**Author:** ![Alex112345](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex112345/32/91016_2.png) [@Alex112345](https://discuss.elastic.co/u/Alex112345)\
**Post date:** [July 1, 2021, 7:42am UTC](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473/3 "2021-07-01T07:42:12Z")

</div>

Hi @warkolm, thank you !

I would need to filter by the percentage of a response;  
i.e I would need to be able to view the data if the percentage of response "1" is over 80%.  
Would such thing be possible?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2021, 7:42am UTC](https://discuss.elastic.co/t/kibana-advanced-search-split-by/277473/4 "2021-07-29T07:42:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.