Search language reference
The XpoLog query language in one place: terms, Boolean operators, wildcards, scoping, column comparisons, regular expressions, the pipe with every function, grouping and view command, formats, and the TRIX correlation operator.
What you will do: write any query from memory — a simple search, a complex search with functions and grouping, or a TRIX correlation — and know which command to reach for.
A query has two parts: a simple search that selects events, and an optional chain of complex search commands after pipe characters that aggregate, group and shape those events into a table. Search shows the console; this page is the syntax.
search query | [function] | [group] | [view] | …
Simple search
| Syntax | Meaning |
|---|---|
error, service control manager | a word, or words adjacent in that order |
"error is not caused by database" | an exact phrase; also protects keywords (( ) = and or not in * ?) |
AND, OR, NOT, parentheses | Boolean operators; the two wiki pages disagree on case and precedence (see below) — group with parentheses |
fail*, 70?3 | wildcards: * zero or more characters, ? exactly one; a bare * is every event |
in log.x, in folder.y, in app.z (= application.), in apptag.t, in host.h (= server.) | scope by source; comma lists, * in names, chained scopes (in log.Application in folder.Windows Event Logs), not in log.a, log.b after the included sources |
column = x, !=, >, <, contains, = NULL, != NULL, NOT (column contains x) | column comparisons on parsed fields; > and < on numeric columns; URL contains (/a and *_304_*) |
regexp:\d+ | a full-match regular expression on the event |
… | regexext (expr) col1,col2 | an advanced regular expression search; exact match per column, wrap in .* for contains; returns the matched value, the event and its source details |
\{\} | special characters escaped with a backslash |
q1 in log.a OR q2 in log.b | different queries on different sources |
search.name, * in search.name | run a saved search, optionally with more commands after it |
${table:value:key:name} | an Environment Table value |
ftype.<type>, in logtype.<type> | a field by its field type (group by ftype.transactionid); logs by their log type |
Time is chosen in the console (All Time, Last 15 Minutes … Last 3 Months, Today, Yesterday, This Week, Last Week, Live, Custom); time is, hour is, minute is, second is, day of week is, day of month is narrow a result to a range inside the query.
Functions
Every function runs on the events selected before the pipe and must precede a grouping.
| Function | Result |
|---|---|
count, countif "query" | number of events, or of events matching the query |
sum col, avg col, min col, max col and sumif, avgif, minif, maxif col "query" | arithmetic on a numeric column, conditional variants per record |
percent | share of events, 100 % until grouped |
percentile N | after list col | order by col asc or desc, drops the top or bottom share |
stdev col | standard deviation |
list col1, col2 | every value of the columns |
dist col | distribution over time of the values (resource-heavy, scope the search first) |
start time, end time, time | first and last event time of a group and the span between them, in milliseconds; display in date or time format |
execute expression (as r1, r2) | a custom computation per event with the execute syntax |
geoip col group by country,city, country col, country code col, region col, city col | GeoIP lookups from the bundled database |
innerjoin "Sources=…;SourceKeys=…;SourceColumns=…;Targets=…;TargetKeys=…;TargetColumns=…" | events present in two logs on shared keys (custom function installed under conf/ext/scripts/complex/user/) |
datastream | events and bytes per source — the in-product volume meter |
analyticstream | Analytics results with name, type (Autodetected / Predefined), risk 1–10 and count |
monitors | every monitor with its state (OK / ALERT), executions, triggers, tags and risk |
anomaly [mergealgorithms:true] | outliers of a count | group by … | interval … series with the algorithm, time, description, confidence, change and value; see Anomaly detection |
trix … | correlation into complex events; see below |
Grouping and views
| Command | Effect |
|---|---|
group by col1, col2 [in … format] | one row per combination; ext.log, ext.folder, ext.server group by source |
interval N milliseconds|seconds|minutes|hours|days|weeks|months [starting TIME] | time buckets |
order by col asc|desc | sort (ascending by default) |
first N [for each col], last N [for each col] | the first or last events or rows, per group when asked |
where query | filter the summary table (where count < 500) |
display col as Name [in … format], … | rename or format columns |
display only col, … | choose and format the columns shown |
Formats, on display, display only and group by: number, simple, time (microsec, ms, sec, min, hour, day), date ("yyyy-MM-dd"), volume (B, KB, MB, GB), regexp ("…(group)…"), expression, query ("q1","Name1","*","Rest"), eventquery, exception ("lines","show message"), replace ("200","OK",…), useragentdetect ("browser+version"), substract, timefromnow, compareEpoch, validateSla, convertToDate, lowercase, uppercase. With one unit the input is assumed to be milliseconds or bytes.
* in log.access | count | group by remote host | interval 15 minutes | count | interval 15 minutes | display count as number of users
* in log.access | avg bytes sent | group by remote host | display avg in volume format ("KB","MB")
* in log.access | count | group by status in query format ("status=200","VALID","*","ALL_THE_REST")
error or exception | count | interval 1 day
TRIX
TRIX connects events that share a key into a complex event (CE) and lets you analyse, monitor and alert on the transaction instead of the lines:
<search query> | trix trix.uniqueIds.fields = (user) any of the listed columns is the key <search query> | trix trix.uniqueIds.fields = (user+pid) all listed columns together are the key
Optional parameters: trix.uniqueSubIds.fields (a secondary key that can open a CE or join one keyed by a uniqueId, but cannot bridge two uniqueId CEs and should not close one), cep.name, cep.groups, cep.type (columns that name, group and type a CE), cep.maxEventLimit, cep.timeframe.limit, cep.event.timeframe.limitFromStart, startRule = (…), endRule = (…), enrichments.<name>.first|all = (col). Each CE returns cep.id, cep.starttime, cep.endtime, cep.eventscount, cep.time, cep.startEvent, cep.endEvent, cep.key, cep.name, cep.groups, cep.groups.count, cep.type, cep.logIds, cep.hosts, cep.<enrichment> and cep.fullstate (OPEN, CLOSE, TIME CLOSE, VOLUME CLOSE, CLOSE PARTIAL, UNKNOWN), all usable with where, avg, list and display. The syntax page spells the limits cep.…; the 2024 examples page spells them cepNode.….
* in log.security | trix trix.uniqueIds.fields = (account name) cep.groups = (event) | where cep.groups = 4625 * in log.audit | trix trix.uniqueIds.fields = (user) startRule = (Event Description contains session has started) endRule = (Event Description contains was terminated) | where cep.startEvent = true AND cep.endEvent = true * in log.audit | trix trix.uniqueIds.fields = (user) | avg cep.time as Average, max cep.time as Max | display Average in time format, Max in time format
TRIX shipped in build 7.9387; see Correlation for how LogX uses it.
Where the wiki pages disagree
The 2024 Simple Searches page capitalizes the Boolean operators and gives the precedence OR, AND, NOT; the Search Query Panel page shows them in lower case with AND before OR. Group with parentheses and the question does not arise.
Next: Saved searches and export
Source: XPLG wiki, pages 1594130424, 1594130411, 1594130505, 1594130698, 1594130702, 1594130508, 1598685503, 1594130533, 1594130515, 1594130513, 1594130510, 1598685506, 1598685510, 1598685508, 1598685512, 1597964383, 1595637827, 1595637936, 1597964376, 1597964378, 1594130557, 1594130559, 1594130555, 1594130561, 1594130539, 1594130525, 1594130527, 1594130531, 1594130529, 1602191804, 1602584807, 1602191858, 1602191855, 1602191861, 1594130535, 1594130553, 1594130547, 1594130551, 1594130549, 1594130543, 1594130545, 1594130541, 1594130851, 1598685525, 1718583297, 1720057914, 1715994628, 1735327763, 1594130570, 2736095240 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594130505).
