where operator

Filters out a dataset to a branch of rows that meets a condition when executed.


| where condition


ConditionbooleanA bool expression over the fields of the dataset, it is then checked for each row in your dataset


Rows in dataset for which condition is true.


| where method == 'GET' and content_type == 'image/jpeg'

Using * has in APL's where Operator

The * has pattern in APL is a dynamic and powerful tool within the where operator. It offers users the flexibility to search for specific substrings across all fields in a dataset without the need to specify each field name individually. This becomes especially advantageous when dealing with datasets that have numerous or dynamically named fields.

Basic where * has Usage

Find events where any fields contains a specific substring.

| where * has "GET"

Combining Multiple Substrings:

Find events where any field contains one of multiple substrings.

| where * has "GET" or * has "text"

Using * has with other operators

Suppose you want to find events where any field contains a substring, and another specific field equals a certain value.

| where * has "css" and req_duration_ms == 1

Advanced Chaining

Filter data based on several conditions, including fields containing certain substrings, then summarize by another specific criterion.

| where * has "GET" and * has "css"
| summarize Count=count() by method, content_type, server_datacenter

Using with Aggregates

Find the average of a specific field for events where any field contains a certain substring.

| where * has "japan"
| summarize avg(req_duration_ms)

String Case Transformation

If you're unsure about the case of the substring in the dataset, convert everything to lowercase for comparison.

| where * has "japan"
| summarize avg(req_duration_ms)

Was this page helpful?