Gaurav Shinde

Basic SPL Queries

1. Simple Search: To find all events containing a specific keyword, use a search query like search error. This will return all events that include the word "error".

2. Time Range Search: To search for events within a specific time range, you can modify the simple search to include time parameters. For example, search error earliest=-1h latest=now will find all events containing "error" that occurred within the last hour.

3. Field-Specific Search: To find events where a specific field contains a certain value, you can specify the field in your search. For example, search status=404 will return all events where the status field equals 404.

Intermediate SPL Queries

4. Using Boolean Operators: To combine multiple search criteria, you can use Boolean operators like AND, OR, and NOT. For instance, search error AND status=404 will find events that contain both the word "error" and have a status of 404.

5. Field Extraction: To extract fields from events and make them available for further analysis, use the rex command. For example, search error | rex field=_raw "user=(?<username>\w+)" will extract the username from events containing "error".

6. Table Command: To display specific fields in a table format, use the table command. For example, search error | table _time, host, status will show the time, host, and status fields in a tabular format for events containing "error".

Advanced SPL Queries

7. Statistical Analysis: To perform statistical analysis, you can use the stats command. For example, search error | stats count by status will count the number of occurrences of each status code for events containing "error".

8. Timechart: To create a time-based chart of your data, use the timechart command. For example, search error | timechart count by status will create a time-based chart showing the count of each status code over time for events containing "error".

9. Subsearches: To use the result of one search as the input for another search, use subsearches. For example, search [search error | head 10 | fields host] will first find the top 10 hosts with errors and then use those hosts to search for all related events.

10. Join Command: To combine results from multiple searches, use the join command. For example, search type=access | join session_id [search type=error] will join access logs with error logs based on a common field, session_id.

11. Lookup Command: To enrich your data with external information, use the lookup command. For example, search error | lookup user_info.csv user_id OUTPUT user_name will add the user_name field from an external CSV file based on the user_id field in your events.