Commands

Pipe commands follow |. The left side is the search clause (search is optional).

Search and time

Search clause

Syntax

[search] <logicalExpression>
index="<name>" AND <field> <op> <value>

Retrieve events from indexes by conditions. Values support exact match, or * / ? wildcards.

Operators

Operator	Meaning
`=` / `==`	Equals
`!=` / `<>`	Not equals
`<` / `<=` / `>` / `>=`	Compare
`like` / `not like`	Contains / not contains
`AND` / `OR`	And / or (`AND` binds tighter; use parentheses)

Examples

index="Linux" AND eventType="login"
(index="linux" AND action="closed") OR (index="windows" AND action="login")

times

Syntax

| times [earliest=<time>] [latest=<time>]

Set the time range inside the statement (overrides the UI time picker).

Examples

… | times earliest=-1h@h latest=now
… | times earliest=-24h@h latest=now

Field operations

fields

Syntax

| fields [+|-] field1, field2, …

Keep or drop fields.

Sign	Meaning
`+` (default)	Keep only listed fields
`-`	Drop listed fields

Examples

… | fields src_ip, dest_ip, action
… | fields - _raw

table

Syntax

| table field1, field2, …

Emit table columns in declaration order. Column order matches the declaration.

Examples

… | table _time, src_ip, dest_ip, action

rename

Syntax

| rename <old> as <new> [, <old> as <new> …]

Rename fields.

Examples

… | rename src_ip as source_ip, dest_ip as destination_ip

sort

Syntax

| sort [+|-]<field> [, [+|-]<field> …]

Order results.

Item	Description
`+`	Ascending (default)
`-`	Descending

Examples

… | sort - _time, + src_ip

Derive and aggregate

eval

Syntax

| eval <field>=<expression> [, <field>=<expression> …]

Create or overwrite fields from expressions. Multiple expressions evaluate left to right. Comparisons support string/integer mixed types.

Examples

… | eval lowuser = lower(username)
… | eval ok = if(status_code == 200, "Y", "N")

where

Syntax

| where <logicalExpression>

Filter inside the pipe by a boolean expression (the search keyword is also accepted).

Examples

… | where bytes > 1000 AND like(host, "web%")
… | where cidrmatch(src_ip, "10.0.0.0/8")

stats

Syntax

| stats <agg>([field]) [as <alias>] [, …] [by <field-list | span(…)>]

Aggregate statistics. Without by, returns one row; with by, one row per key. Common aggregations: count, sum, avg, min, max, values, earliest, latest, variance and stddev family.

Examples

index="Linux" AND eventType="login"
| stats count() as total by userName

… | stats sum(bytes) as total_bytes, avg(bytes) as avg_bytes by src_ip

earliest / latest (in stats)

Take earliest / latest-side aggregate values for non-time fields. Sort by time first:

… | sort _time
| stats earliest(src_ip) as first_ip, latest(alarm_name) as last_alarm by src_port

Truncate and frequency

head

Syntax

| head [<n>]

Take the first N rows.

Examples

… | head 100

limit

Syntax

| limit <n>
| limit <offset>, <n>

Limit returned rows; optional offset.

Examples

… | limit 50
… | limit 10, 50

top

Syntax

| top [<n>] <field-list> [by <field-list>]

Most frequent values for the listed fields.

Examples

… | top 10 src_ip
… | top 5 user by host

rare

Syntax

| rare <field-list> [by <field-list>]

Least frequent values for the listed fields.

Examples

… | rare userName by host

eventcount

Syntax

| eventcount

Count events in the current result.

Dedup and fill

dedup

Syntax

| dedup [<n>] <field-list> [keeptype=<bool>] [consecutive=<bool>]

Deduplicate by field combination. Optionally keep the first N rows per key.

Examples

… | sort - _time | dedup src_ip, userName

fillnull

Syntax

| fillnull [value=<literal>] [<field-list>]

Replace nulls with a value.

Examples

… | fillnull value="N/A" owner, dept

filldown

Syntax

| filldown [<field-list>]

Fill downward from the last non-null value.

fillup

Syntax

| fillup [<field-list>]

Fill upward from the next non-null value.

Lookup and merge

lookup

Syntax

| lookup <file.csv> <lookup-field> [as <event-field>]
    OUTPUT|OUTPUTNEW <out-field> [as <alias>] [, …]

Join a CSV lookup table by field and write matched columns onto the result. Left-side results can stream in batches; converge high-cardinality keys with stats / dedup first.

Examples

… | lookup asset.csv ip as src_ip OUTPUT application_name, owner

inputlookup

Syntax

| inputlookup <file.csv> [method=<string>]

Read lookup table contents directly. Files default to $ORI_HOME/etc/lookup/ (or the site-configured path).

Examples

| inputlookup product.csv

outputlookup

Syntax

| outputlookup <file.csv> [append=true|false]

Write the current result to a CSV lookup table.

Parameter	Default	Description
`append`	`false`	`true` appends; otherwise overwrite
`<file.csv>`	—	Must end with `.csv`

Examples

… | outputlookup threat_ips.csv
… | outputlookup threat_ips.csv append=true

join

Syntax

| join [type=left|inner|outer|right] <field> [, <field> …] [ <subsearch> ]

Merge a subsearch by shared fields.

Examples

… | join type=inner src_ip [ index="asset" | fields src_ip, owner ]

append / appendcols

Syntax

| append [ <subsearch> ]
| appendcols [ <subsearch> ]

Append another subsearch to the current result (row append or column align).

Multivalue fields

makemv

Syntax

| makemv <field> [delim="<sep>"] [tokenizer="<regex>"] [allowempty=<bool>] [setsv=<bool>]

Split a single-value field into multivalue by delimiter.

mvexpand

Syntax

| mvexpand <field> [limit=<n>]

Expand a multivalue field into multiple rows.

mvcombine

Syntax

| mvcombine <field> [delim="<sep>"]

Combine rows into a multivalue field.

Extract and geo

rex

Syntax

| rex [mode=sed] [field=<field>] "<regex-or-sed>"

Extract fields with named capture groups, or mode=sed for substitution. Default source field is _raw. Avoid special characters such as _ in new field names.

Examples

… | rex field=_raw "From: (?<from>.*) To: (?<to>.*)"
… | rex field=savedsearch_id "(?<user>\w+);(?<app>\w+);(?<SavedSearchName>\w+)"

parse

Syntax

| parse <expression> <pattern>

Parse fields from an expression by pattern.

spath

Syntax

| spath [input=<field>] path="<json-path>" [output=<field>]

Extract a path from a JSON structured field.

Parameter	Default	Description
`input`	`_raw`	Input field
`output`	path name	Output field
`path`	—	e.g. `foo.bar` or with array indexes

Examples

… | spath input=_raw output=myfield path=foo.bar

iplocation

Syntax

| iplocation <ip-field> [allfields=true|false] [prefix="<prefix>"] [lang="<lang>"]

Enrich an IP field with geo data from the local ipdb.

Parameter	Default	Description
`<ip-field>`	required	e.g. `src_ip`
`allfields`	`false`	`true` emits extended fields
`prefix`	empty	Output field name prefix
`lang`	`CN`	Geo database language

Default output fields: city_name, region_name, country_name, country_code, continent_code, latitude, longitude, timezone.

Configuration

Item	Value
Database file	`mydata4vipday3_cn.ipdb`
Default directory	`/opt/oriData/var/geo/ipdb`
Overrides	`spl.geo.home`, or env `VAR_DIR` / `ORI_HOME`

Queries fail if the database is missing. The service exposes local authenticated HTTP (no public network): POST /spl/geo/ip/batch, GET /spl/geo/health, POST /spl/geo/reload.

Examples

index="firewall"
| iplocation src_ip allfields=true prefix="geo_" lang="CN"
| fields src_ip, geo_country_name, geo_city_name

Commands

On this page