Command Reference
Specify commands in your query string to perform specific actions on the search results.
The first and implicit command in a query is the search
command. This command consists of a series of keywords, and fieldname-value pairs, which identify the data that needs to be retrieved. More commands can be specified by separating them from the search
command by using a pipe character (|
).
The following commands are supported:
Command | Description |
---|---|
addfields |
Generate aggregated data within the results generated by
|
bottom |
Display a specific number of results with the lowest aggregated value as determined by the specified field. |
bucket |
Group the log records into buckets based on the range of values of a field. |
classify |
Cluster properties of groups identified by the
|
cluster |
Group similar log records. |
clustercompare |
Compare one cluster collection with another, and for viewing the clusters that exist exclusively in the current range versus clusters that exist exclusively in the baseline range. |
clusterdetails |
Look at log data within categories for specific
|
clustersplit |
View the log data within a cluster for specific
|
compare |
Compare properties generated by the
|
createtable |
Tabulate one or more fields from |
createview |
Define a subquery to create a subset of groups
identified by the |
dedup |
Remove results that contain identical combination of field values
based on the search order generated through the
|
delta |
Compute the difference between a numeric property in a
group, and another numeric property in a previous group, in the sort
order of groups when the |
distinct |
Remove duplicates from the returned results. |
eval |
Calculate the value of an expression and display the value in a new field. |
eventstats |
Obtain overall summary statistics, optionally grouped by
fields, on properties of the results generated by
|
extract |
Obtain excerpts of an existing field using a regular expression. |
fields |
Specify which fields to add or remove from the retrieved results, based on the field names. |
fieldsummary |
Return data for the specified fields. |
frequent |
Display n results of the most frequent values of all fields in the field list. |
geostats |
Provide summary statistics, grouped by the Client Host Coordinates field. |
head |
Display the first n number of results. |
highlight |
Match a string or a list of strings, and highlight them in the Log UI. |
highlightgroups |
Match strings or search criteria on the properties of the
groups identified by any grouping command such as
|
highlightrows |
Match a string or a list of strings, and highlight the entire row in the Log UI. |
jsonextract |
Obtain excerpts of an existing field using a Json Path from JSON format data. |
link |
Group log records into high level business transactions. |
lookup |
Invoke field value lookups. |
map |
Join a view that was created using the
|
nlp |
Apply natural language processing algorithms to a text field. |
outlier |
Find irregular or uncommon field values in the results. |
rare |
Display n results of the least frequent values of all fields in the field list. You can optionally group by additional fields. |
regex |
Filter data according to a specified regular expression. |
rename |
Change the name of a field. |
search |
Retrieve a specific logical expression from the available log data. |
searchlookup |
Retrieve contents from a lookup table. |
sequence |
Search for log record patterns within groups identified by the
|
sort |
Sort logs according to specified fields. |
stats |
Provide summary statistics for the search results, optionally grouped by a specified field. |
tail |
Display the last n number of results. |
timecluster |
Group the timeseries charts together based on how similar they are to one another. |
timecompare |
Generate columns with the results from all the aggregate
columns generated by the previous |
timestats |
Generate data for displaying statistical trends over time, optionally grouped by a specified field. |
top |
Display either the specified number of field values with the most occurrences or the specified number of results with the highest aggregated value as determined by the specified field. |
updatetable |
Update an existing table created using the
|
where |
Calculate the value of an expression to be true or false. |
xmlextract |
Obtain excerpts of an existing field using XPath from an XML document. |