Filtering facet expressions

How do I filter a facet expression? I’ve got this query:

select count(*) as num FROM Log FACET event.key1 where event.key2 = ‘value2’ and event.key1 is not null and event.status = 500 SINCE 1 week ago order by num

I would expect that the nulls would be filtered out, but that doesn’t seem to be the case.

I think you are missing your WHERE.

No, I have a where. “where event.key2 = ‘value2’ and event.key1 is not null and event.status = 500”.

It turns out my ingestion process is putting in the string “null” for event.key1, so my where needs to be “where event.key2 = ‘value2’ and event.key1 != ‘null’ and event.status = 500”

So you do. Sorry. I would typically put the facet at the end and the where just after the event type(s) if starting the statement with Select.

So you got it sorted or still need help?

I have it sorted, thanks. :slight_smile:

And I’m used to SQL syntax, so when I write a query, it tends to be in the form “SELECT <fields> FROM <source> WHERE <conditions>” :smiley:

Great. Yea, it all works.

So you can do things like this also:

Select count(*), filter(count(*), where event.key != 'null' and event.status = '500'), percentage(count(*), where event.key != 'null' and event.status = '500') from log facet event.key1 limit max since 1 week ago

1 Like