HAVING

Log Parser

HAVING

<having_clause> ::= HAVING <expression>

The HAVING clause is used to specify a boolean condition that must be satisfied by a group for the group record to be output. Groups that do not satisfy the condition are discarded.


Examples:

A. Simple expression

HAVING EventID = 501

B. Complex expression

HAVING SUM(sc-bytes) > 100000 AND
       ( COUNT(*) > 1000 OR
         EXTRACT_EXTENSION(cs-uri-stem) LIKE 'htm'
       )

C. Complex expression

The following example query retrieves all the event sources from the System event log that generated more than 10 events:
SELECT SourceName
FROM System
GROUP BY SourceName
HAVING COUNT(*) > 10


See also:

Expressions
WHERE

Filtering Groups


© 2004 Microsoft Corporation. All rights reserved.