Thanks for your immediate reply.................

in $filter they are using conditions like itime>= and itime<=......

select distinct split_part(split_part(cp.msg, 'src=',1),',',1),split_part(split_part(cp.msg, 'user=''',2),',',1) as user ,am.itime,am.dtime,am.url from "FGT60B3908669009-wlog-1380091698" am join "SYSLOG-C0A80A41-glog-1380347892" cp on cast(am.src as character varying)=cast((split_part(split_part(cp.msg, 'src=',2),',',1) ) as character varying) where am.src='192.168.10.23' and replace('$filter', 'itime', 'am.itime')

This is my query......

if the user what 1 day reports it takes long time for querying because of large data..... so i want to replace itime with my am.itime in $ filter............

for more details pls come online in gmail.(shobanapraveen80@gmail.com)

Thanks,

Shobana