# where()

`where(filter)` returns every row from the input stream except those that don't pass `filter`.

`filter` is specified using the [standard query syntax](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/query-syntax).

<mark style="background-color:yellow;">**Note:**</mark> <mark style="background-color:yellow;">`where`</mark> <mark style="background-color:yellow;">does</mark> *<mark style="background-color:yellow;">**not**</mark>* <mark style="background-color:yellow;">use</mark> [<mark style="background-color:yellow;">scalar functions and operators</mark>](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators)<mark style="background-color:yellow;">. E.g.</mark> <mark style="background-color:yellow;">`* | where foo`</mark> <mark style="background-color:yellow;">will match all rows that contain the string token</mark> <mark style="background-color:yellow;">`foo`</mark><mark style="background-color:yellow;">, not all rows where the column</mark> <mark style="background-color:yellow;">`foo`</mark> <mark style="background-color:yellow;">resolves to</mark> <mark style="background-color:yellow;">`true`</mark><mark style="background-color:yellow;">.</mark>

## Returns

The same table as the input, less rows that fail to pass `filter`. Note that this can result in zero rows.

## Examples

```python
# Returns only servers where the greatest elapsed time is at least 10 seconds
* | stats max(elapsed_ms) as elapsed_ms by hostname | where elapsed_ms > 10000
```