Tabular OperatorsFilter Operators
where
Filters rows based on a boolean predicate expression.
Only rows where the predicate evaluates to true are included in the output.
The predicate is any boolean expression built from scalar operators — comparison, membership (in, in~), and the string operators (contains, has, …) — combined with and, or, and not.
Syntax
where predicateFilter rows by condition
Parameters
| Name | Description |
|---|---|
| predicate | Boolean expression that determines which rows to include |
Examples
Example 1
datatable(warrior:string, voyages:long, weapon:string)[
"Ragnar", 42, "axe",
"Bjorn", 31, "sword",
"Lagertha", 28, "spear",
"Ivar", 35, "bow",
"Floki", 12, "hammer"
]
| where voyages > 30| warrior (string) | voyages (long) | weapon (string) |
|---|---|---|
| Bjorn | 31 | sword |
| Ivar | 35 | bow |
| Ragnar | 42 | axe |
Example 2
datatable(ship:string, crew:long, destination:string)[
"Naglfar", 80, "Lindisfarne",
"Wave Rider", 45, "York",
"Storm Bear", 60, "Paris"
]
| where destination == "Lindisfarne"| ship (string) | crew (long) | destination (string) |
|---|---|---|
| Naglfar | 80 | Lindisfarne |
Example 3
datatable(warrior:string, voyages:long, weapon:string)[
"Ragnar", 42, "axe",
"Bjorn", 31, "sword",
"Lagertha", 28, "spear",
"Ivar", 35, "bow"
]
| where voyages > 30 and weapon == "axe"| warrior (string) | voyages (long) | weapon (string) |
|---|---|---|
| Ragnar | 42 | axe |
Example 4
datatable(ship:string, crew:long, seaworthy:bool)[
"Naglfar", 80, true,
"Old Knarr", 20, false,
"Wave Rider", 45, true
]
| where not (seaworthy)| ship (string) | crew (long) | seaworthy (bool) |
|---|---|---|
| Old Knarr | 20 | false |
Example 5
datatable(warrior:string, weapon:string)[
"Ragnar", "axe",
"Bjorn", "sword",
"Lagertha", "spear",
"Floki", "axe"
]
| where weapon in ("axe", "sword")| warrior (string) | weapon (string) |
|---|---|
| Bjorn | sword |
| Floki | axe |
| Ragnar | axe |
Example 6
datatable(events:dynamic)[
dynamic([{"type":"raid", "target":"Lindisfarne"}, {"type":"trade", "target":"York"}]),
dynamic([{"type":"trade", "target":"Paris"}, {"type":"trade", "target":"Dublin"}])
]
| where events[*].type == "raid"| events (dynamic) |
|---|
| [{"target":"Lindisfarne","type":"raid"},{"target":"York","type":"trade"}] |