How to limit the aggregate value like 'having' in sql

[arunbs]

Hi, I want to filter the records after aggrigating it, almost similar to 'having' in sql. Here is search query:

source="rest://Data" 
| eval limit = substr(CreationDate, 1,4) | where limit = 2013 
| where 
(projectName=="Proj-1")  OR  
| chart 
dc(eval(case(State=="QA",ObjectID))) as "QA", 
dc(eval(case(State=="Dev",ObjectID))) as "Dev"
by Owner

Here, i want to show only those owners who have a non-zero QA count.

Thanks in advance.
Arun.

[arunbs]

Thanks kristian and daniels for the quick answers. It indeed helps us to get what we wanted and also optimized it.

[sdaniels]

Take a look at this. Gives a nice comparison and a Splunk example to match the SQL.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk

[kristian_kolb · Accepted solution]

I'm not quite sure I follow what you want to achieve. You can probably do this more efficiently;

The following would be a good start, but there was a missing statement after the 'OR' in your search:

source="rest://data" CreationDate=2013* State = QA OR State = Dev projectName=Proj-1 OR <something else> | chart dc(ObjectID) by State, Owner

Hope this helps,

K