Splunk Search

How to use 'where' command in multiple places?

rajhemant26
New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Does this do what you need:

index=appweec sourcetype=dxejje host=* 
|stats p90(CURDEPTH) AS "QueueDepth" p90(MSGAGE) as "MessageAge" by QUEUE _time
where (QUEUE=MESSAGE.ACTION.Q   QueueDepth > 1200 MessageAge > 400) OR (QUEUE=INCOMING.MESSAGEACTION.WIN.SYSLOW.Q QueueDepth > 0 AND MessageAge > 0)
0 Karma

FrankVl
Ultra Champion

You're missing a | before the where, other than that, I think that should do it indeed.

0 Karma

FrankVl
Ultra Champion

What exactly is your question? Is the search you have now not producing the results you want? If so, please provide info on what is wrong with this search and what out put you want (and perhaps also some info on the data itself).

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...