Complex Search Syntax

Complex search queries are used for performing complex operations on search results. Complex search queries can be executed in the XpoSearch console and can be visualized as gadgets in XpoLog Dashboards.

General syntax
search query | [function] | [group] | [view]

Optional functions
max COLUMN_NAME -> calculates the maximal value of the given column in the search query result

min COLUMN_NAME -> calculates the minimal value of the given column in the search query result

avg COLUMN_NAME -> calculates the average value of the given column in the search query result

count -> counts the number of events in the search query result

sum COLUMN_NAME -> calculates the sum of the given column in the search query result

time -> calculates the time of a process in the search query result, based on some identifier (examples: transaction Id, IP address, etc.)

execute EXPRESSION -> custom complex computation on search query result

Optional groups
group by COLUMN_NAME/S (comma separated)

group by log/application/server (ext.log)

interval [auto | TIME_AMOUNT TIME_UNIT]
   possible time units: auto, minute, hour, day, week, month, year
   example: interval auto, interval 5 minute, interval 1 week

Optional views
order by COLUMN_NAMES [ASC | DESC]: COLUMN_NAMES can be names of columns in the log (in case no function was specified) or a name of a function that was executed
examples:
   * in folder.my logs | count | group by username | order by count DESC
   * in log.access log | order by bytes sent DESC

first NUM_OF_RESULTS: show only the first NUM_OF_RESULTS results
examples:
   * in folder.my logs | count | group by username | order by count DESC | first 10
   * in log.access log | order by bytes sent DESC | first 10

last NUM_OF_RESULTS: show only the last NUM_OF_RESULTS results
examples:
   * in folder.my logs | count | group by username | order by count DESC | last 10
   * in log.access log | order by bytes sent DESC | last 10

display DISPLAY_OPTION: DISPLAY_OPTION can be any of the following:

   display COLUMN_X as COLUMN_Y: change the display name of a column. several column names can be specified in a comma separated list

   display only COLUMN_X: display only COLUMN_X. several column names can be specified in a comma separated list

   display only COLUMN_X as COLUMN_Y: display only COLUMN_X and change its display name to COLUMN_Y. several column names can be specified in a comma separated list

   display GENERAL_DISPLAY_CLAUSE: display result value in a customized manner (combine several fields, add prefix/suffix to the result value)

   display TIME_DISPLAY_CLAUSE: format a time interval value. TIME_DISPLAY_CLAUSE can be any of the following:
      display TIME_INTERVAL_COLUMN in time format: assumes that the value in TIME_INTERVAL_COLUMN is in milliseconds and displays it in the maximal possible unit (if the value is 2000, the output will be 2 seconds, if the value is 120000, the output will be 2 minutes etc.)
      display TIME_INTERVAL_COLUMN in time format("OUTPUT_UNIT"): assumes that the value in TIME_INTERVAL_COLUMN is in milliseconds and displays it in OUTPUT_UNIT (see below for optional values) (if OUTPUT_UNIT is min and the value is 15000, the output will be 0.25 minutes etc.)
      display TIME_INTERVAL_COLUMN in time format("INPUT_UNIT","OUTPUT_UNIT"): assumes that the value in TIME_INTERVAL_COLUMN is in INPUT_UNIT (see below for optional values) and formats it in OUTPUT_UNIT (if INPUT_UNIT is sec, OUTPUT_UNIT is hour and the value is 360, the output will be 0.1 hours etc.)
      optional time units are:
         ms, sec min, hour, day

   display VOLUME_DISPLAY_CLAUSE: format a volume value. VOLUME_DISPLAY_CLAUSE can be any of the following:       display VOLUME_INTERVAL_COLUMN in volume format: assumes that the value in VOLUME_INTERVAL_COLUMN is in bytes and displays it in the maximal possible unit (if the value is 2048, the output will be 2KB etc.)
      display VOLUME_INTERVAL_COLUMN in volume format("OUTPUT_UNIT"): assumes that the value in VOLUME_INTERVAL_COLUMN is in bytes and displays it in OUTPUT_UNIT (see below for optional values) (if OUTPUT_UNIT is KB and the value is 512, the output will be 0.5KB etc.)
      display VOLUME_INTERVAL_COLUMN in time format("INPUT_UNIT","OUTPUT_UNIT"): assumes that the value in VOLUME_INTERVAL_COLUMN is in INPUT_UNIT (see below for optional values) and formats it in OUTPUT_UNIT (if INPUT_UNIT is KB, OUTPUT_UNIT is MB and the value is 512, the output will be 0.5MB etc.)
      optional volume units are:
         B, KB, MB, GB

   display REGEXP_DISPLAY_CLAUSE: use a regular expression to extract values from a value. REGEXP_DISPLAY_CLAUSE can be the following:
      display COLUMN in regexp format("REGEXP"), where REGEXP is the regular expression to be executed on the value in COLUMN

   display NUMBER_DISPLAY_CLAUSE: change the display format of a number value. NUMBER_DISPLAY_CLAUSE can be the following:
   display NUMBER_COLUMN in number format("FORMAT"), where FORMAT is the desired format (for example #.##)