This topic describes how to use the function in the Splunk Data Stream Processor.
The where function uses <boolean-expressions> to filter records. The where function only returns the results that evaluate to true.
Function Input/Output schema
- Function Input
- This function takes in collections of records with schema R.
- Function Output
- This function outputs collections of records with schema R.
The required syntax is in bold.
- where <boolean-expression>
- Syntax: <boolean-expression>
- Description: A scalar function that returns a boolean value. See Boolean operators.
The order in which Boolean expressions are evaluated with the
where function is:
- Expressions within parentheses
- NOT clauses
- AND clauses
- OR clauses
1. Filter for records that occur past a specific timestamp
Return records that have a timestamp greater than 1546329600 (Tuesday, 01-Jan-2019 08:00:00 GMT+0000).
...| where timestamp > 1546329600L |...;
2. Filters for records with 400, 401, 403, 404 values in the status field
Return records with 400, 401, 403, or 404 in the custom top-level
... | where status in("400", "401", "403", "404") | ...;
3. Filters out records that are null in the _value field
Returns records where the
_value is not null.
...| where _value IS NOT "null" |...;
4. Filters for records that do not match a timestamp rule
The Apply Timestamp Extraction function adds a
_rule field to the outgoing data. In order to better organize your data, you can filter for records where
_rule is equal to NULL.
...| where map_keys(_rule) IS NULL |...;
5. Filters for records with WinEventLog source_type using a regular expression
Returns records that have the source_type "WinEventLog".
...| where match_regex(source_type, /(?i)WinEventLog/) |...;
6. Filters for records with either syslog source_type or vmstat source_type
Returns records that have either syslog or vmstat as their source_type.
...| where source_type="syslog" OR source_type="vmstat" |...;
7. Returns only records where the
source_type field begins with "cisco".
You can only specify a wildcard with the where function by using the
like operator. The percent ( % ) symbol is the wildcard you must use with the like operator. The where function returns like=TRUE if the source_type field starts with the value cisco.
...| where like(source_type, "cisco%") |...;
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0