where

Lean how to filter out a dataset to a branch of rows that meets a condition when executed.

Filters out a dataset to a branch of rows that meets a condition when executed.

Syntax

| where condition

Arguments

name	type	description
Condition	boolean	A bool expression over the fields of the dataset, it is then checked for each row in your dataset

Returns

Rows in dataset for which condition is true.

Examples

['sample-http-logs']
| where method == 'GET' and content_type == 'image/jpeg'

Run in Playground

Using * has in APL’s where Operator

The * has pattern in APL is a dynamic and powerful tool within the where operator. It offers users the flexibility to search for specific substrings across all fields in a dataset without the need to specify each field name individually. This becomes especially advantageous when dealing with datasets that have numerous or dynamically named fields.

Basic where * has Usage

Find events where any fields contains a specific substring.

['sample-http-logs'] 
| where * has "GET"

Run in Playground

Combining Multiple Substrings:

Find events where any field contains one of multiple substrings.

['sample-http-logs'] 
| where * has "GET" or * has "text"

Run in Playground

Using * has with other operators

Suppose you want to find events where any field contains a substring, and another specific field equals a certain value.

['sample-http-logs'] 
| where * has "css" and req_duration_ms == 1

Run in Playground

Advanced Chaining

Filter data based on several conditions, including fields containing certain substrings, then summarize by another specific criterion.

['sample-http-logs']
| where * has "GET" and * has "css"
| summarize Count=count() by method, content_type, server_datacenter

Run in Playground

Using with Aggregates

Find the average of a specific field for events where any field contains a certain substring.

['sample-http-logs']
| where * has "japan"
| summarize avg(req_duration_ms)

Run in Playground

String Case Transformation

If you’re unsure about the case of the substring in the dataset, convert everything to lowercase for comparison.

['sample-http-logs']
| where * has "japan"
| summarize avg(req_duration_ms)

Run in Playground