Example: Adds information about the search to each event in the search results.

from <dataset> ...| addinfo

Example: Search for "404" events and append the fields in each event to the list of host values returned from the incoming search results.

from main 
| fields host 
| appendcols [search 404]

Example: Looks for events that are purchase actions and appends the results of the top IP addresses by category ID to the current results.

The top command is not supported in SPL2. The subsearch in the append command uses embedded SPL to include top command in the search.

from <dataset> 
| where action="purchase"
| sort clientip 
| stats dc(clientip) BY categoryId
| append [search action="purchase" | `top 1 clientip BY categoryId`]

Embedded SPL is a shortcut associated with the spl1 command.

Example: The following example append subtotals for each action across all users.

from main
| stats count() AS user_count BY action, clientip
| appendpipe [stats sum(user_count) AS 'User Count' BY action | eval user = "TOTAL - USER COUNT"] 
| sort action

Example: Return the average for a field for a specific time span. Bin the search results using a 5 minute time span on the _time field. Return the average thruput of each host for each 5 minute time span.

...| bin span=5m _time | stats avg(thruput) by _time, host

Example: The following example changes the duration values to seconds for the specified fields.

... | convert dur2sec(xdelay), dur2sec(delay)

For the Edge Processor solution, see Use the decrypt command to decrypt data in the Edge Processor solution in the Use Edge Processors manual.

For the Ingest Processor solution, see Use the decrypt command to decrypt data in the Ingest Processor solution in the Use Ingest Processors manual.

... | eval velocity=distance/time

Example: Use the if function to analyze field values. Create a new field called error in each event. Using the if function, set the value in the error field to OK if the status value is 200. Otherwise set the error field value to Problem.

... | eval error = if(status == 200, "OK", "Problem")

... | expand bridges

Here are the results after the expand command is run:

Example: Return the summary statistics for all incoming fields.

...| fieldsummary

Example: Return the summary statistics for a specific field.

...| fieldsummary fields=[action]

Example: The following example fills all empty field values in the host and kbps fields with the string unknown:

... | fillnull value="unknown" host, kbps

The from command has a flexible syntax, which enables you to start a search with either the FROM clause or the SELECT clause.

Example: The following example adds information about the IP address to each event:

...| iplocation clientip

Example: The following example specifies the search ID for the search results that you want to load into a new search.

| loadjob 1233886270.2

Append the data returned from your search results with the data in the users lookup dataset using the uid field. For search results that contains a uid field, the value in that field is matched with the uid field in the users lookup dataset. The username and department fields from the users lookup dataset are appended to each search result. If the search results already have the username and department fields, the OUTPUTNEW argument only fills in missing values in those fields.

... | lookup users uid OUTPUTNEW username, department

Example: The following example separates values in the senders field using a comma ( , ) as the delimiter:

... | makemv delim=","  senders

Example: The following example separates the values in the my_multival field using a regular expression.

... | makemv tokenizer="([^,]+),?" my_multival

Example: The following example generates 5 events. Using the streamstats and eval commands to create different dates in the _time field:

| makeresults count=5 
| streamstats count
| eval _time=_time-(count*86400)

Example: The following example shows how to calculate a single metric grouped by time. This example returns the average value of the aws.ec2.CPUUtilization metric in the mymetricdata metric index. Use the bin command to bucket the results into 30 second time spans.

| mstats aggregates=[avg('aws.ec2.CPUUtilization')] predicate=(index=mymetricdata) | bin span=30s

Example: The following example creates a multivalue field from the values in the host field by using the comma as a delimiter:

... | mvcombine delim="," host

Example: The following example combines the values in the senders field, which is a multivalue field, into a single value where each value is separated by a new line delimiter.

from main where eventtype="sendmail" | nomv senders

Example: The following example changes a value in two fields in the search results, the start_month and end_month fields.

... | replace str="aug" replacement="August" start_month, end_month

... | rex field=savedsearch_id "(?<user>\\w+);(?<app>\\w+);(?<SavedSearchName>\\w+)"

If the contents of the field is savedsearch_id=bob;search;my_saved_search then this rex command syntax extracts user=bob, app=search, and SavedSearchName=my_saved_search.

search src="192.0.2.0"

Example: Search for multiple field-value pairs with boolean and comparison operators. This example searches for events with code values of either 10, 29, or 43 and any host that is not "localhost", and an xqp value that is greater than 5.

search (code=10 OR code=29 OR code=43) host!="localhost" xqp>5

Example: The following example shows how to specify an output field and path with a wildcard for JSON data:

... | spath output=commit_author path="commits{}.author.name"

error OR http_code=404

Embed this search into an SPL2 search using the backtick ( ` ) character syntax:

`search index=main error OR http_code=404`

Example: In this SPL2 search only the portion of the search not supported by SPL2, the addinfo command, uses the backtick ( ` ) character syntax:

from sample_data_index | stats sum(bytes) BY host | `addinfo`

Example: The following example returns a table with only the host and action fields.

...| table host, action

Example: The following example creates a field called mytags and returns the tags for only the host and clientip fields. The tag information will include the field name associated with the tag. The field list must be specified after the other parameters.

...| tags outputfield=mytags inclname=true host, clientip

Example: The following example specifies only the required parameters. Aggregates must be enclosed in square brackets ( [ ] ). However, because no indexes are specified, the search performs a count of the fields for all of the indexes in the module.

| tstats aggregates=[count()]

Example: The following example returns only events with the successful purchases event type and limits the number of characters to search each event to 300.

...| typer eventypes="successful purchases" maxlen=300

| union customers, orders, vendors

Example: Append the current results of the main search with the tabular results of errors from the subsearch.

... | stats count() BY category1 | union [search error | stats count() BY category2]

Example: The following example adds the untable command to the previous example and converts the results from the stats command.

from main where status=200 | stats count() by host, status | untable host, label, data

... | where ipaddress like "192.%"

Example: Compare one field to another field.

... | where ipaddress=clientip

Example: Filter using a field-value pair.

... | where host="www1"