B Log Queries: Quick Reference

Here are some examples about how to phrase Search queries.

Search queries can be grouped as

• Reporting Queries

• Grouping Queries

• Filtering Queries

Reporting Queries

Requirement	Query
Return count of logs grouped by entity type, severity.	* | stats count by ‘entity type’, severity
Return time series for count of fatal logs.	severity=’fatal’ | timestats count
Return the top 5 entities and their type with fatal logs.	severity='fatal' | stats count as 'fatal count' by entity, ‘entity type' | top limit=5 'fatal count'
Return the top 50 distinct entities as well as the count of logs for each of those entities.	* | stats count as 'count by entity’ by entity | top limit=50 'count by entity’

Grouping Queries

Requirement	Query
Perform cluster analysis on fatal logs and save it in a collection called “Fatal logs”.	severity='fatal' | cluster collection='fatal logs'
Return the fatal logs that were included in summary ID 10002000002 and 10032000002 in the collection ‘Fatal logs’.	Severity = fatal | clusterdetails collection = 'Fatal Logs' id in (10002000002, 10032000002)

Filtering Queries

Requirement	Query
Return logs that do not contain 404 in their raw text.	not 404
Return logs that contain FAIL in their raw text or have a fatal severity.	FAIL or Severity = fatal