You can apply this operation either as a Filter or Create column operation:
Retrieves those events where all the given Boolean column values are true.
Creates a Boolean column that returns true only if all the given arguments are true.
How does it work in the search window?
Select Filter / Create column in the search window toolbar, then select the And operation. This operation requires at least two Operand arguments, but you can add more as needed.
If you use the Create column operation, the data type of the values in the new column is boolean (true or false).
demo.ecommerce.data table, we want to display only those events where the bytes transferred are greater than 1000 and the time taken to send them is greater than 200. To do it, we will apply a Filter using the And operation but first, we need to create the required Boolean columns.
Step 1: Create the dedicated columns with Boolean values
We need two new columns. One for the first condition (bytesTransferred>1000), and one for the second condition (timeTaken>200). Here is how we define these columns, using the Greater than (gt, >) operation.
Once created, we will have two Boolean columns containing a true or false value for each row.
Step 2: Apply the filter using the And operation
Select Filter on the query toolbar, then select And as the operator. Now select the columns that you created as arguments:
- Operand - bytestransferred>1000 column
- Operand - timetaken>200 column
Click Filter data. The table displays only those rows where both the timetaken>200 and bytestransferred>1000 values are true.
Click Create column and follow the same steps to add a new Boolean column that shows true only when both the timetaken>200 and bytestransferred>1000 values are true.
How does it work in LINQ?
Use the operator
where... to apply the Filter operation and
as... to apply the Create column operation. This is the syntax for the And operation:
boolean1 and boolean2 and ...
You can copy the following LINQ script and try the above example on the
from demo.ecommerce.data select bytesTransferred > 1000 as `bytesTransferred>1000`, timeTaken > 200 as `timeTaken>200` where `bytesTransferred>1000` and `timeTaken>200`
And this is the same example using the Create column operation:
from demo.ecommerce.data select timeTaken > 200 as `timeTaken>200`, bytesTransferred > 1000 as `bytesTransferred>1000`, `timeTaken>200` and `bytesTransferred>1000` as `time>200&bytes>1000`