where command uses
eval expressions to filter search results. The search keeps only the results for which the evaluation was successful (that is, the Boolean result was true).
- Syntax: <string>
- Description: A combination of values, variables, operators, and functions that represent the value of your destination field.
The syntax of the eval expression is checked before running the search, and an exception will be thrown for an invalid expression.
- The result of an eval statement is not allowed to be boolean. If the expression cannot be successfully evaluated for a particular event at search-time, eval erases the value in the result field.
- If the expression references a field name that contains non-alphanumeric characters, it needs to be surrounded by single quotes; for example,
- If the expression references literal strings that contains non-alphanumeric characters, it needs to be surrounded by double quotes; for example,
The where command includes the following functions:
abs, case, ceil, ceiling, cidrmatch, coalesce, commands, exact, exp, floor, if, ifnull, isbool, isint, isnotnull, isnull, isnum, isstr, len, like, ln, log, lower, ltrim, match, max, md5, min, mvappend, mvcount, mvindex, mvfilter, mvjoin, mvrange, mvzip, now, null, nullif, pi, pow, random, relative_time, replace, round, rtrim, searchmatch, sha1, sha256, sha512, sigfig, spath, split, sqrt, strftime, strptime, substr, time, tonumber, tostring, trim, typeof, upper, urldecode, validate..
For descriptions and examples of each function, see "Evaluation functions".
where command uses the same expression syntax as the
eval command. Also, both commands interpret quoted strings as literals. If the string is not quoted, it is treated as a field name. Because of this, you can use the
where command to compare two different fields, which you cannot use the
search command to do.
Example 1: Return "CheckPoint" events that match the IP or is in the specified subnet.
host="CheckPoint" | where like(src, "10.9.165.%") OR cidrmatch("10.9.165.0/25", dst)
Example 2: Return "physicsjobs" events with a speed is greater than 100.
sourcetype=physicsjobs | where distance/time > 100
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the where command.
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.5.0