topic How to use 'where' command in multiple places? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427328#M172587 <P>Hello everyone.</P> <P>Want to display the output only for the time which crosses 18 months (earliest time)</P> Mon, 11 Mar 2019 07:13:19 GMT rajhemant26 2019-03-11T07:13:19Z How to use 'where' command in multiple places? https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427328#M172587 <P>Hello everyone.</P> <P>Want to display the output only for the time which crosses 18 months (earliest time)</P> Mon, 11 Mar 2019 07:13:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427328#M172587 rajhemant26 2019-03-11T07:13:19Z Re: How to use 'where' command in multiple places? https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427329#M172588 <P>What exactly is your question? Is the search you have now not producing the results you want? If so, please provide info on what is wrong with this search and what out put you want (and perhaps also some info on the data itself).</P> Mon, 11 Mar 2019 07:58:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427329#M172588 FrankVl 2019-03-11T07:58:30Z Re: How to use 'where' command in multiple places? https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427330#M172589 <P>Does this do what you need:</P> <PRE><CODE>index=appweec sourcetype=dxejje host=* |stats p90(CURDEPTH) AS "QueueDepth" p90(MSGAGE) as "MessageAge" by QUEUE _time where (QUEUE=MESSAGE.ACTION.Q QueueDepth &gt; 1200 MessageAge &gt; 400) OR (QUEUE=INCOMING.MESSAGEACTION.WIN.SYSLOW.Q QueueDepth &gt; 0 AND MessageAge &gt; 0) </CODE></PRE> Mon, 11 Mar 2019 08:13:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427330#M172589 chrisyounger 2019-03-11T08:13:43Z Re: How to use 'where' command in multiple places? https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427331#M172590 <P>You're missing a <CODE>|</CODE> before the where, other than that, I think that should do it indeed.</P> Mon, 11 Mar 2019 08:42:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-command-in-multiple-places/m-p/427331#M172590 FrankVl 2019-03-11T08:42:17Z