HAVING
<having_clause> | ::= |
HAVING <expression> |
The HAVING clause is used to specify a boolean condition that must be satisfied by a
group for the group record to be output. Groups that do not satisfy the condition
are discarded.
Examples:
A. Simple expression
HAVING EventID = 501B. Complex expression
HAVING SUM(sc-bytes) > 100000 AND ( COUNT(*) > 1000 OR EXTRACT_EXTENSION(cs-uri-stem) LIKE 'htm' )C. Complex expression
The following example query retrieves all the event sources from the System event log that generated more than 10 events:SELECT SourceName FROM System GROUP BY SourceName HAVING COUNT(*) > 10
See also:
ExpressionsWHERE