
where command examples
The where
command expects a predicate expression. See Predicate expressions in the SPL2 Search Manual.
In most cases you can use the WHERE clause in the from
command instead of using the where
command separately.
1. Specify wildcards
You can only specify a wildcard with the where
command by using the like
function. The percent ( % ) symbol is the wildcard you must use with the like
function.
In this example, the where
command returns search results for values in the ipaddress
field that start with 198.
.
... | where like(ipaddress, "198.%")
The like
function supports several syntaxes, see Comparison and Conditional functions.
2. Match IP addresses or a subnet using the where command
Return events that match the IP or is in the specified subnet. This example uses both the like
function and the cidrmatch
function.
...| where like(src, "10.9.165.%") OR cidrmatch("10.9.165.0/25", dst)
3. Specify a calculation in the where command expression
Return events with a speed is greater than 100.
... | where distance/time > 100
See also
PREVIOUS where command usage |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!