Hi, I want to filter the records after aggrigating it, almost similar to 'having' in sql. Here is search query:
source="rest://Data"
| eval limit = substr(CreationDate, 1,4) | where limit = 2013
| where
(projectName=="Proj-1") OR
| chart
dc(eval(case(State=="QA",ObjectID))) as "QA",
dc(eval(case(State=="Dev",ObjectID))) as "Dev"
by Owner
Here, i want to show only those owners who have a non-zero QA count.
Thanks in advance.
Arun.
I'm not quite sure I follow what you want to achieve. You can probably do this more efficiently;
The following would be a good start, but there was a missing statement after the 'OR' in your search:
source="rest://data" CreationDate=2013* State = QA OR State = Dev projectName=Proj-1 OR <something else> | chart dc(ObjectID) by State, Owner
Hope this helps,
K
Thanks kristian and daniels for the quick answers. It indeed helps us to get what we wanted and also optimized it.
Take a look at this. Gives a nice comparison and a Splunk example to match the SQL.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk
I'm not quite sure I follow what you want to achieve. You can probably do this more efficiently;
The following would be a good start, but there was a missing statement after the 'OR' in your search:
source="rest://data" CreationDate=2013* State = QA OR State = Dev projectName=Proj-1 OR <something else> | chart dc(ObjectID) by State, Owner
Hope this helps,
K