where
Lean how to filter out a dataset to a branch of rows that meets a condition when executed.
Filters out a dataset to a branch of rows that meets a condition when executed.
Syntax
| where condition
Arguments
name | type | description |
---|---|---|
Condition | boolean | A bool expression over the fields of the dataset, it is then checked for each row in your dataset |
Returns
Rows in dataset for which condition is true.
Examples
['sample-http-logs']
| where method == 'GET' and content_type == 'image/jpeg'
Using * has in APL’s where Operator
The * has pattern in APL is a dynamic and powerful tool within the where operator. It offers users the flexibility to search for specific substrings across all fields in a dataset without the need to specify each field name individually. This becomes especially advantageous when dealing with datasets that have numerous or dynamically named fields.
Basic where * has Usage
Find events where any fields contains a specific substring.
['sample-http-logs']
| where * has "GET"
Combining Multiple Substrings:
Find events where any field contains one of multiple substrings.
['sample-http-logs']
| where * has "GET" or * has "text"
Using * has with other operators
Suppose you want to find events where any field contains a substring, and another specific field equals a certain value.
['sample-http-logs']
| where * has "css" and req_duration_ms == 1
Advanced Chaining
Filter data based on several conditions, including fields containing certain substrings, then summarize by another specific criterion.
['sample-http-logs']
| where * has "GET" and * has "css"
| summarize Count=count() by method, content_type, server_datacenter
Using with Aggregates
Find the average of a specific field for events where any field contains a certain substring.
['sample-http-logs']
| where * has "japan"
| summarize avg(req_duration_ms)
String Case Transformation
If you’re unsure about the case of the substring in the dataset, convert everything to lowercase for comparison.
['sample-http-logs']
| where * has "japan"
| summarize avg(req_duration_ms)