where

The where operator filters events based on the specified predicate.

Syntax

​

Scope | where Predicate

Arguments

​

• Scope: The events to search.
• Predicate: An expression that returns a bool value for each event. This can match on strings, numeric values, or regular expressions.

Comparison and String Operators in where

​

You can construct a Predicate using the comparison and string operators shown below. Note the abbreviations used in these tables:

• Operators with a _cs suffix are case-sensitive.
• RHS = right-hand side of the predicate.
• LHS = left-hand side of the predicate.

Comparison Operators in where

​

To compare on wildcards (*), use the comparison operators of the cribl operator. The where operator supports wildcards only inside regex literals (/^abc.*xyz$/).

When comparing values of different types, Cribl Search performs automatic type conversion wherever possible, giving priority to number comparisons.

Some comparison examples:

• “1.0” == 1 is true
• “1.0” == “1” is true
• 5 < 100 is true
• “5” < “100” is true
• “abc” < “100” is false
• “abc” < 100 is null

String Operators in where

​

To search on wildcards (*), use the string operators of the cribl operator. The where operator supports wildcards only inside regex literals (/^abc.*xyz$/).

Results

​

Returns events for which the Predicate evaluates to true.

Examples

​

Here are a few examples of how to use the where operator in queries.

Simple Comparisons First

​

This example retrieves events that are no older than 1 hour, come from a source called MyCluster, and have two fields containing the same value:

dataset=myDataset
| where Timestamp > ago(1h)
    and Source == "MyCluster"
    and ActivityId == SubActivityId

Columns Contain String

​

Retrieve all the events in which the word “Cribl” appears on word boundaries in field:

dataset=myDataset
| where field has "Cribl"

In where string comparisons, note that : is a substitute for the has operator. So in the above example, where field:"Cribl" is equivalent to where field has "Cribl".

Match on AND Condition

​

Return results where the field event is greater than 20 and parity is odd.

dataset=$vt_dummy event<100
| extend parity=iif(event%2==0, 'even', 'odd')
| where event>20 and parity=='odd'

Match on OR Condition

​

Return results that match either of two conditions:

dataset="cribl_internal_logs" | limit 50 | where method == "GET" or method == "POST"

Match with Regex

​

The where operator supports regular expressions to match against strings or regex literals. You can see this in action in our Regex Examples.

Search on Non-String Values

​

When using where to search on non-string values (such as int numbers), omit the quotes ("", ''). For example, instead of dataset=$vt_dummy event<"10", do this:

dataset=$vt_dummy event<10

An exception to this is searching for high-precision decimal numbers.