WHERE Clause

Overview

Use the WHERE clause to specify one or more condition expressions separated by logical operators such as AND, OR.

The WHERE clause uses the following syntax:

[WHERE condition_expression]

See ADQL Expressions for a description of the condition expression syntax. Condition expressions use Comparison Operators.

Warning: Splunk AppDynamics recommends that you do not use periods (.) in the field name, otherwise, the syntax will break.

Examples

To filter logs based on error or warning log level, use a query similar to the following:

SELECT * FROM logs WHERE sourceType='yourLogFile' AND (logLevel=’ERROR’ OR logLevel=’WARN’)