getting results based on conditions

[shari]

hi,

i need to build a query that fetches me results based on a condition, 

index=<myindex>  host=<myhost>  |rex field=_raw ".*TimeInMs=(?<TimeInMs>\d+)" | table host,  TimeInMs

here in my case, i need only those host values where TimeInMs is greater than 120000.

Appreciate your help in correct query for the same.

[ITWhisperer · Accepted solution]

index=<myindex>  host=<myhost>  
|rex field=_raw ".*TimeInMs=(?<TimeInMs>\d+)" 
| where TimeInMs > 120000
| table host,  TimeInMs

You may need to convert TimeInMs to a number

| eval TimeInMs=tonumber(TimeInMs)