Filtering data

When you aggregate data, sometimes you want to filter based on the results of the aggregate functions. Use the HAVING clause to filter after the aggregation, like this:

| FROM main GROUP BY host SELECT sum(bytes) AS sum, host HAVING sum > 1024*1024

This example only returns rows for hosts that have a sum of bytes that is greater than 1 megabyte (MB).

Next step

See More information on searching and SPL2.