how to use where parameter?

[sunnyparmar]

Hi,

I am using where clause but it is not giving any result. It showing the result as (0) in counts section. My query is -

eventtype="email_fetching" Fetching | where count>80 | stats count

Kindly suggest where I am wrong?

Thanks
Ankit

[stephanefotso]

Hello! Put the where clause after the count.

    eventtype="email_fetching" Fetching| stats count as totalcount | where totalcount>80 

Thanks

[sunnyparmar]

thanks buddy.. It works..

[aholzer · Accepted solution]

You want to place the where clause after your stats count. Like so:

eventtype="email_fetching" Fetching  | stats count | where count>80

Hope this helps

[sunnyparmar]

thanks buddy.. It works..

[sunnyparmar]

My logs are showing on splunk like given below -

INFO [main] 05-21 10:00:53 Fetching 0 messages. Total 0 messages. (Reading.java:270)