Splunk Search

How to use 'where' command in multiple places?

rajhemant26
New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Does this do what you need:

index=appweec sourcetype=dxejje host=* 
|stats p90(CURDEPTH) AS "QueueDepth" p90(MSGAGE) as "MessageAge" by QUEUE _time
where (QUEUE=MESSAGE.ACTION.Q   QueueDepth > 1200 MessageAge > 400) OR (QUEUE=INCOMING.MESSAGEACTION.WIN.SYSLOW.Q QueueDepth > 0 AND MessageAge > 0)
0 Karma

FrankVl
Ultra Champion

You're missing a | before the where, other than that, I think that should do it indeed.

0 Karma

FrankVl
Ultra Champion

What exactly is your question? Is the search you have now not producing the results you want? If so, please provide info on what is wrong with this search and what out put you want (and perhaps also some info on the data itself).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...