Splunk Search

Were to use where and when to use OR when to use AND

MeMilo09
Path Finder

Hi Guys, 

I am novice somewhat, and confusion has struck.

Where does the | where clause go in the query? Is it before stats typically or after, end of query? 

Also, AND -- I understand to use this when I want for example both burger and fries -- so like I want my results to show me both burger and fries so I would query - (burger AND fries)  ---- or is this OR instead of and? When would I use OR instead ? 

Would like just some brief examples. Thanks in advance 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @MeMilo09,

about the where command, you can find all the information at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

In few words, it's usually used when you have to check the result (true or false) of an eval condition (e.g. | where value>100).

About the boolean operators, you can find more information at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/UnderstandingSPLsyntax#Boolean_op...

in few words: OR must be always used, instead AND isn't mandatory in a search, but it's mandatory in the conditions (e.g. in eval command).

Put attention to the difference between NOT and != https://docs.splunk.com/Documentation/Splunk/8.2.0/Search/NOTexpressions

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @MeMilo09,

about the where command, you can find all the information at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

In few words, it's usually used when you have to check the result (true or false) of an eval condition (e.g. | where value>100).

About the boolean operators, you can find more information at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/UnderstandingSPLsyntax#Boolean_op...

in few words: OR must be always used, instead AND isn't mandatory in a search, but it's mandatory in the conditions (e.g. in eval command).

Put attention to the difference between NOT and != https://docs.splunk.com/Documentation/Splunk/8.2.0/Search/NOTexpressions

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @MeMilo09,

good for you,see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...