When you aggregate data, sometimes you want to filter based on the results of the aggregate functions. Use the
HAVING clause to filter after the aggregation, like this:
| FROM main GROUP BY host SELECT sum(bytes) AS sum, host HAVING sum > 1024*1024
This example only returns rows for hosts that have a sum of bytes that is greater than 1 megabyte (MB).
Grouping search results
More information on searching and SPL2
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!