How to use 'where' command in multiple places?

[rajhemant26]

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

[chrisyounger]

Does this do what you need:

index=appweec sourcetype=dxejje host=* 
|stats p90(CURDEPTH) AS "QueueDepth" p90(MSGAGE) as "MessageAge" by QUEUE _time
where (QUEUE=MESSAGE.ACTION.Q   QueueDepth > 1200 MessageAge > 400) OR (QUEUE=INCOMING.MESSAGEACTION.WIN.SYSLOW.Q QueueDepth > 0 AND MessageAge > 0)

[FrankVl]

You're missing a | before the where, other than that, I think that should do it indeed.

[FrankVl]

What exactly is your question? Is the search you have now not producing the results you want? If so, please provide info on what is wrong with this search and what out put you want (and perhaps also some info on the data itself).