Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

How to limit the aggregate value like 'having' in sql

$
0
0

Hi, I want to filter the records after aggrigating it, almost similar to 'having' in sql. Here is search query:

source="rest://Data" 
| eval limit = substr(CreationDate, 1,4) | where limit = 2013 
| where 
(projectName=="Proj-1")  OR  
| chart 
dc(eval(case(State=="QA",ObjectID))) as "QA", 
dc(eval(case(State=="Dev",ObjectID))) as "Dev"
by Owner

Here, i want to show only those owners who have a non-zero QA count.

Thanks in advance. Arun.


Viewing all articles
Browse latest Browse all 13053

Trending Articles