where command examples
where command expects a predicate expression. See Predicate expressions in the SPL2 Search Manual.
In most cases you can use the WHERE clause in the
from command instead of using the
where command separately.
1. Specify wildcards
You can only specify a wildcard with the
where command by using the
like function. The percent ( % ) symbol is the wildcard you must use with the
In this example, the
where command returns search results for values in the
ipaddress field that start with
... | where like(ipaddress, "198.%")
like function supports several syntaxes, see Comparison and Conditional functions.
2. Match IP addresses or a subnet using the where command
Return events that match the IP or is in the specified subnet. This example uses both the
like function and the
...| where like(src, "10.9.165.%") OR cidrmatch("10.9.165.0/25", dst)
3. Specify a calculation in the where command expression
Return events with a speed is greater than 100.
... | where distance/time > 100
where command usage
This documentation applies to the following versions of Splunk® Cloud Services: current