Quick reference
SPL cheat sheet and SQL concept map
Quick reference
Concept map
| Database concept | SPL concept | Note |
|---|---|---|
| SQL query | SPL search | Retrieve events; pipe to filter, transform, group, aggregate |
| Table | Search results | Dynamic rows (events) and columns (fields) |
| Table name | index | Index name |
| Row | Event | Usually one timestamped log record |
| Column | Field | Field set follows the statement and parse rules |
From SQL to SPL
| Intent | SQL (sketch) | SPL (sketch) |
|---|---|---|
| Full scan | SELECT * FROM mytable | index="mytable" |
| Filter | WHERE col=5 | index="t" col=5 or | where col=5 |
| Project | SELECT a, b | | fields a, b or | table a, b |
| Sort | ORDER BY a DESC | | sort - a |
| Limit | LIMIT 10 | | head 10 or | limit 10 |
| Group count | COUNT(*) GROUP BY user | | stats count() by user |
| Derived column | lower(u) AS lu | | eval lu=lower(u) |
| Rename | AS | | rename old as new |
| Distinct | DISTINCT | | dedup field |
| Dimension join | JOIN | | lookup dim.csv key OUTPUT name |
Typical pipeline order
Search operators
| Operator | Meaning |
|---|---|
= / == | Equals |
!= / <> | Not equals |
< / <= / > / >= | Compare |
like / not like | Pattern (% multi-char, _ single) |
AND / OR | And / or (AND binds tighter; use parentheses) |
Wildcards: * zero or more characters, ? single character.
Command index
| Command | Purpose |
|---|---|
where | Filter inside the pipe |
fields / table | Keep or present fields |
rename | Rename |
sort | Sort |
eval | Derive fields |
stats | Aggregate |
dedup | Deduplicate |
head / limit | Truncate rows |
top / rare | Frequent / rare values |
lookup / inputlookup / outputlookup | Lookup tables |
join / append / appendcols | Merge results |
iplocation | IP geo enrichment |
rex / parse / spath | Extract fields |
makemv / mvexpand / mvcombine | Multivalue |
fillnull / filldown / fillup | Null handling |
times | In-statement time range |