where(filter) returns every row from the input stream except those that don't pass filter.

filter is specified using the standard query syntax.


The same table as the input, less rows that fail to pass filter. Note that this can result in zero rows.


# Returns only servers where the greatest elapsed time is at least 10 seconds
* | stats max(elapsed_ms) as elapsed_ms by hostname | where elapsed_ms > 10000

Last updated