https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391246#M113924 <P>That is not valid syntax. Replace the second <CODE>where</CODE> with <CODE>AND</CODE>.</P> Thu, 07 Mar 2019 13:01:12 GMT woodcock 2019-03-07T13:01:12Z https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391243#M113921 <P>I'm trying to write an ANTLR grammar for Splunk queries and an example of the queries that my system receives is as follows : </P> <PRE><CODE>...|append[|tstats count where (index=accm_*) earliest=1d@d latest=now where (index=accm_*) siteId="my_site",selectors{}.categories{}=* by selectors{}.categories{}|... </CODE></PRE> <P>I do not see in the documentation how the previous statement could have where specified twice. Could someone please explain this to me?</P> Tue, 19 Feb 2019 15:47:14 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391243#M113921 inovexsean 2019-02-19T15:47:14Z https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391244#M113922 <P>Um ... .... ....... ? Please rephrase with 500% more text at a minimum.</P> Thu, 07 Mar 2019 05:21:24 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391244#M113922 woodcock 2019-03-07T05:21:24Z https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391245#M113923 <P>Not entirely sure what your on about either, but that second <CODE>where</CODE> doesn't make any sense there, same for the <CODE>,</CODE> after <CODE>siteId="my_site"</CODE>.</P> Thu, 07 Mar 2019 08:11:34 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391245#M113923 FrankVl 2019-03-07T08:11:34Z https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391246#M113924 <P>That is not valid syntax. Replace the second <CODE>where</CODE> with <CODE>AND</CODE>.</P> Thu, 07 Mar 2019 13:01:12 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391246#M113924 woodcock 2019-03-07T13:01:12Z https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391247#M113925 <P>Thanks. That was my suspicion, but I'm not familiar enough with the QL to be certain. The queries are written by other people and we're just auditing them.</P> Thu, 07 Mar 2019 13:33:34 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-WHERE-s-in-Query/m-p/391247#M113925 inovexsean 2019-03-07T13:33:34Z