Version:

Page Contents

Table of Contents

Table of Contents¶

Search Query Language
Simple Search
- Single word
- Multiple words
- Phrases
- Field values
- Logical operators
  - And
  - Or
  - Not
- Parentheses
- Wildcards
- Step
- Lower and Upper
- Time Functions
  - second
  - minute
  - hour
  - day
  - day of week
  - month
- List
- Table
Aggregators
- chart
- timechart
- Available Aggregators
  - avg()
  - count()
  - distinct_count()
  - distinct_list()
  - list()
  - max() and min()
  - sum()
  - var()
One-to-One Commands
- rex
- norm
- Important Consideration
- fields
- rename
Process Commands
- AsciiConverter
- Clean Char
- Codec
- Compare
- Compare Network
- Count Char
- CountOf
- Current Time
- DatetimeDiff
- Difference
- DNS Cleanup
- DNS Process
- Domain Lookup
- Entropy
- Eval
- Experimental Median Quartile Quantile
- GEOIP
- Grok
- InRange
- IP Lookup
- JSON Expand
- JSON Parser
- ListLength
- ListPercentile
- Next
- Percentile
- Process lookup
- Regex
- SortList
- String Concat
- Summation
- toList
- toTable
- WhoIsLookup
Filtering Commands
- search
- filter
- latest
- order by
- limit <number>
Pattern Finding
- Single Stream
- Multiple Streams
  - Left Join
  - Right Join
  - Join
  - Followed by
Chaining of commands
Additional Notes

Helpful?