# where()

`where(filter)` returns every row from the input stream except those that don't pass `filter`.

`filter` is specified using the [standard query syntax](/scanner/using-scanner-complete-feature-reference/querying-and-analysis/query-syntax.md).

<mark style="background-color:yellow;">**Note:**</mark> <mark style="background-color:yellow;">`where`</mark> <mark style="background-color:yellow;">does</mark> *<mark style="background-color:yellow;">**not**</mark>* <mark style="background-color:yellow;">use</mark> [<mark style="background-color:yellow;">scalar functions and operators</mark>](/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators.md)<mark style="background-color:yellow;">. E.g.</mark> <mark style="background-color:yellow;">`* | where foo`</mark> <mark style="background-color:yellow;">will match all rows that contain the string token</mark> <mark style="background-color:yellow;">`foo`</mark><mark style="background-color:yellow;">, not all rows where the column</mark> <mark style="background-color:yellow;">`foo`</mark> <mark style="background-color:yellow;">resolves to</mark> <mark style="background-color:yellow;">`true`</mark><mark style="background-color:yellow;">.</mark>

## Returns

The same table as the input, less rows that fail to pass `filter`. Note that this can result in zero rows.

## Examples

```python
# Returns only servers where the greatest elapsed time is at least 10 seconds
* | stats max(elapsed_ms) as elapsed_ms by hostname | where elapsed_ms > 10000
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/where.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.