help on where condition

[jip31]

hi

I need to add a where condition on the field 'Time period with no info' below
But the where command doesn't works even if there is an existing field with "08:53:07-000" value
What I have to do please??

| where 'Time period with no info' = "08:53:07-000" 
| stats dc(USERNAME)

[kamlesh_vaghela]

@jip31

Have you tried by renaming column name before where? like below.

YOUR_SEARCH 
| rename "Time period with no info" as Temp 
| where Temp = "08:53:07-000"

[jip31]

now it works thanks

[kamlesh_vaghela]

Great @jip31
Can you please upvote and accept the answer to close this question?

[KailA]

I tried this

| makeresults
| eval "Time period with no info" = "08:53:07-000"
| where 'Time period with no info' = "08:53:07-000"

and it seems to work so could you please send us the full search or maybe an example of your data to have more informations ? 🙂