hi
I need to add a where condition on the field 'Time period with no info' below
But the where command doesn't works even if there is an existing field with "08:53:07-000" value
What I have to do please??
| where 'Time period with no info' = "08:53:07-000"
| stats dc(USERNAME)
@jip31
Have you tried by renaming column name before where? like below.
YOUR_SEARCH
| rename "Time period with no info" as Temp
| where Temp = "08:53:07-000"
now it works thanks
Great @jip31
Can you please upvote and accept the answer to close this question?
I tried this
| makeresults
| eval "Time period with no info" = "08:53:07-000"
| where 'Time period with no info' = "08:53:07-000"
and it seems to work so could you please send us the full search or maybe an example of your data to have more informations ? 🙂