where
Table of Contents
Operator
where — select values based on a Boolean expression
Synopsis
[where] <expr>
Description
The where operator filters its input by applying a Boolean expression <expr>
to each input value and dropping each value for which the expression evaluates
to false or to an error.
The where keyword is optional since it is an
implied operator.
The “where” keyword requires a boolean-valued expression and does not support search expressions. Use the search operator if you want search syntax.
When SuperPipe queries are run interactively, it is highly convenient to be able to omit the “where” keyword, but when where filters appear in query source files, it is good practice to include the optional keyword.
Examples
An arithmetic comparison
where this >= 21
2
3Loading...The “where” keyword may be dropped
this >= 21
2
3Loading...A filter with Boolean logic
where this >= 2 AND this <= 21
2
3Loading...A filter with array containment logic
where this in [1,4]1
2
3
4Loading...A filter with inverse containment logic
where ! (this in [1,4])1
2
3
4Loading...Boolean functions may be called
where is(<int64>)1
"foo"
10.0.0.1Loading...Boolean functions with Boolean logic
where is(<int64>) or is(<ip>)1
"foo"
10.0.0.1Loading...