topic Re: how to use where parameter? in Splunk Search

how to use where parameter?

sunnyparmar — Tue, 16 Jun 2015 06:35:52 GMT

Hi,

I am using where clause but it is not giving any result. It showing the result as (0) in counts section. My query is -

eventtype="email_fetching" Fetching | where count>80 | stats count

Kindly suggest where I am wrong?

Thanks
Ankit

sunnyparmar — Tue, 16 Jun 2015 06:38:52 GMT

My logs are showing on splunk like given below -

INFO [main] 05-21 10:00:53 Fetching 0 messages. Total 0 messages. (Reading.java:270)

aholzer — Tue, 16 Jun 2015 06:58:15 GMT

You want to place the where clause after your stats count. Like so:

eventtype="email_fetching" Fetching  | stats count | where count>80

Hope this helps

stephanefotso — Tue, 16 Jun 2015 07:00:00 GMT

Hello! Put the where clause after the count.

    eventtype="email_fetching" Fetching| stats count as totalcount | where totalcount>80

Thanks

sunnyparmar — Tue, 16 Jun 2015 07:38:18 GMT

thanks buddy.. It works..

sunnyparmar — Tue, 16 Jun 2015 07:38:23 GMT

thanks buddy.. It works..