Command Reference

Specify commands in your query string to perform specific actions on the search results.

The first and implicit command in a query is the search command. This command consists of a series of keywords, and fieldname-value pairs, which identify the data that needs to be retrieved. More commands can be specified by separating them from the search command by using a pipe character (|).

The following commands are supported:

Command Description
addfields

Generate aggregated data within the results generated by link, stats, or timestats commands.

bottom

Display a specific number of results with the lowest aggregated value as determined by the specified field.

bucket

Group the log records into buckets based on the range of values of a field.

classify

Cluster properties of groups identified by the link command.

cluster

Group similar log records.

clustercompare

Compare one cluster collection with another, and for viewing the clusters that exist exclusively in the current range versus clusters that exist exclusively in the baseline range.

clusterdetails

Look at log data within categories for specific classify results. It enables you to expand a message signature into the individual log entries.

clustersplit

View the log data within a cluster for specific classify results in the tabular format.

compare

Compare properties generated by the link command over the comparison intervals specified.

createtable

Tabulate one or more fields from link command results.

createview

Define a subquery to create a subset of groups identified by the link command.

dedup

Remove results that contain identical combination of field values based on the search order generated through the sort command.

delta

Compute the difference between a numeric property in a group, and another numeric property in a previous group, in the sort order of groups when the delta command is run.

distinct

Remove duplicates from the returned results.

eval

Calculate the value of an expression and display the value in a new field.

eventstats

Obtain overall summary statistics, optionally grouped by fields, on properties of the results generated by link, stats, or timestats commands. Its output will include one field for each aggregation.

extract

Obtain excerpts of an existing field using a regular expression.

fields

Specify which fields to add or remove from the retrieved results, based on the field names.

fieldsummary

Return data for the specified fields.

frequent

Display n results of the most frequent values of all fields in the field list.

geostats

Provide summary statistics, grouped by the Client Host Coordinates field.

head

Display the first n number of results.

highlight

Match a string or a list of strings, and highlight them in the Log UI.

highlightgroups

Match strings or search criteria on the properties of the groups identified by any grouping command such as stats, link, or timestats, and causes them to be highlighted in the visualization.

highlightrows

Match a string or a list of strings, and highlight the entire row in the Log UI.

jsonextract

Obtain excerpts of an existing field using a Json Path from JSON format data.

link

Group log records into high level business transactions.

lookup

Invoke field value lookups.

map

Join a view that was created using the createview command, with the groups identified by the link command to create new properties.

nlp

Apply natural language processing algorithms to a text field.

outlier

Find irregular or uncommon field values in the results.

rare

Display n results of the least frequent values of all fields in the field list. You can optionally group by additional fields.

regex

Filter data according to a specified regular expression.

rename

Change the name of a field.

search

Retrieve a specific logical expression from the available log data.

searchlookup

Retrieve contents from a lookup table.

sequence

Search for log record patterns within groups identified by the link command.

sort

Sort logs according to specified fields.

stats

Provide summary statistics for the search results, optionally grouped by a specified field.

tail

Display the last n number of results.

timecluster

Group the timeseries charts together based on how similar they are to one another.

timecompare

Generate columns with the results from all the aggregate columns generated by the previous timestats command over the comparison interval specified.

timestats

Generate data for displaying statistical trends over time, optionally grouped by a specified field.

top

Display either the specified number of field values with the most occurrences or the specified number of results with the highest aggregated value as determined by the specified field.

updatetable

Update an existing table created using the createtable command. Apply a sub-query or an eval expression to the table, and show or hide fields. This command works only in the link visualization.

where

Calculate the value of an expression to be true or false.

xmlextract

Obtain excerpts of an existing field using XPath from an XML document.