I'm trying to write an ANTLR grammar for Splunk queries and an example of the queries that my system receives is as follows :
...|append[|tstats count where (index=accm_*) earliest=1d@d latest=now where (index=accm_*) siteId="my_site",selectors{}.categories{}=* by selectors{}.categories{}|...
I do not see in the documentation how the previous statement could have where specified twice. Could someone please explain this to me?
That is not valid syntax. Replace the second where
with AND
.
Thanks. That was my suspicion, but I'm not familiar enough with the QL to be certain. The queries are written by other people and we're just auditing them.
Not entirely sure what your on about either, but that second where
doesn't make any sense there, same for the ,
after siteId="my_site"
.
Um ... .... ....... ? Please rephrase with 500% more text at a minimum.