where and eval clause does not work with "AND" condition?

[leonjxtan]

Firstly, with below search, there are events returned:

|from datamodel foo.fooo |search Counterparty=abc TransactionType=xyz

But with below "where", it does not return any events
|from datamodel foo.fooo |where Counterparty=abc AND TransactionType=xyz

I checked WHERE document and could not get a clue what went wrong. Could you help?

[puneethgowda]

|from datamodel foo.fooo | search Counterparty="abc" OR TransactionType="xyz"

[MuS]

This will give you the wrong results, because it is a OR search.

[MuS · Accepted solution]

Can you try it like this:

  |from datamodel foo.fooo |where Counterparty="abc" AND TransactionType="xyz"

[leonjxtan]

yes worked. Thanks. So where and eval require explicit indication of strings/numbers?

[MuS]

Yes, as @woodcock mentioned where will use the right side of the = as field names because it is eval based. search on the other side will treat as strings/numbers.

Feel free to accept this answer if it solved your problem ...

cheers, MuS

[woodcock]

Otherwise it assumes that they are field names.