where command

The where command uses eval expressions to filter search results. Only the results for which the evaluation was True are displayed.

Here is an example. Let’s say that we want to display only the search results that contain the HTTP status code greater than 200. We would use the following command:

where command example

You can combine multiple expressions together. For example, to display only the results that contain the status codes greater than 200 and lower than 500, we can use the following command:

where command example 2

Splunk tutorial

Splunk tutorial

Geek University 2022