topic Re: help on where condition in Splunk Search

help on where condition

jip31 — Mon, 15 Jul 2019 08:40:44 GMT

I need to add a where condition on the field 'Time period with no info' below
But the where command doesn't works even if there is an existing field with "08:53:07-000" value
What I have to do please??

| where 'Time period with no info' = "08:53:07-000" 
| stats dc(USERNAME)

Re: help on where condition

KailA — Mon, 15 Jul 2019 09:26:24 GMT

I tried this

| makeresults
| eval "Time period with no info" = "08:53:07-000"
| where 'Time period with no info' = "08:53:07-000"

and it seems to work so could you please send us the full search or maybe an example of your data to have more informations ? 🙂

Re: help on where condition

kamlesh_vaghela — Mon, 15 Jul 2019 09:30:19 GMT

@jip31

Have you tried by renaming column name before where? like below.

YOUR_SEARCH 
| rename "Time period with no info" as Temp 
| where Temp = "08:53:07-000"

Re: help on where condition

jip31 — Mon, 15 Jul 2019 10:52:36 GMT

now it works thanks

Re: help on where condition

kamlesh_vaghela — Mon, 15 Jul 2019 11:25:08 GMT

Great @jip31
Can you please upvote and accept the answer to close this question?