diff --git a/docs/cse/rules/cse-rules-syntax.md b/docs/cse/rules/cse-rules-syntax.md index e7e4376de6..366ae4c09d 100644 --- a/docs/cse/rules/cse-rules-syntax.md +++ b/docs/cse/rules/cse-rules-syntax.md @@ -1394,7 +1394,12 @@ Filters results based on the value of a boolean expression.   `... | where ` -**Example** +**Examples** -`| where jsonArrayContains(field, “vuln_scanner”)` +* `| where jsonArrayContains(field, “vuln_scanner”)` +* `| where` can be used at the beginning of an expression, as well as on subsequent lines after another syntax element has been used to start a preceding line. For example: + ``` + | json field=fields "foo" as alias + | where toInt(alias) > 5 + ``` \ No newline at end of file