SPL Search Guide

SPL (Search Processing Language) is the query language used in DataOri Data Search. Use it to retrieve indexed events, then pipe results through filters, field transforms, aggregations, lookups, and IP geo enrichment.

This guide describes the syntax and behavior supported in the 2.4 product line.

What you can do

• Search events by index and conditions
• Project, rename, sort, deduplicate, and fill fields with pipe commands
• Derive fields and aggregates with eval / stats
• Enrich with lookup / iplocation
• Reuse statements in search, views, alerts, and dashboards

Before you start

• Target indexes contain data
• Your account can search those indexes
• You know local index names and common fields (_time, src_ip, …)

Guide map

Language structure

An SPL statement is an optional search clause plus zero or more pipe commands:

[<search conditions>]
| <command> <args>
| <command> <args>
…

Search conditions are on the left and usually include index and a boolean expression. The pipe character is |. The search keyword is optional.

index="Linux" AND eventType="login"
| stats count() by userName
| sort - count()
| head 20

• Field names and string literals generally use double quotes
• Boolean relations are AND / OR (case-insensitive; AND binds tighter than OR)
• Comparison operators support string/integer mixed comparison (for example "200" compared to 200)

How to confirm success

• The statement runs in Data Search with no syntax error
• Result columns match fields / table / stats declarations
• For iplocation, the geo database is deployed and output fields are populated