The search operator in APL is a special operator that scans full-text search over the specified datasets. Instead of specifying a particular field or condition, the search operator allows for a broad search across multiple fields for a given text or phrase.
Versatility: It allows users to find a specific text or term across various fields within a dataset that they choose or select for their search, without the necessity to specify each field.
Efficiency: Saves time when you aren’t sure which field or datasets in APL might contain the information you are looking for.
User-Friendliness: It’s particularly useful for users or developers unfamiliar with the schema details of a given database.
search [kind=<Search Kind>] <Search-Expression>
search [kind= CaseSensitivity ] SearchPredicate
|Dataset||string||✓||The data to be searched over in a dataset.|
|CaseSensitivity or Search Kind||string||A flag that controls the behavior of all |
|SearchPredicate or SearchExpression||string||✓||A boolean expression to be evaluated for every event in the input. If it returns |
The SearchPredicate allows you to search for specific terms in all fields of a dataset. The operator that will be applied to a search term depends on the presence and placement of a wildcard asterisk (*) in the term, as shown in the following table.
You can also restrict the search to a specific field, look for an exact match instead of a term match, or search by regular expression. The syntax for each of these cases is shown in the following table.
|FieldName||This syntax can be used to restrict the search to a specific field. The default behavior is to search all fields.|
|FieldName||This syntax can be used to search for exact matches of a field against a string value. The default behavior is to look for a term-match.|
|Field ||This syntax indicates regular expression matching, in which StringLiteral is the regex pattern.|
Use boolean expressions to combine conditions and create more complex searches. For example,
"axiom" and b==789 would result in a search for events that have the term axiom in any field and the value 789 in the b field.
|#||Syntax||Meaning (equivalent ||Comments|
|10||All string comparisons are case-sensitive|
|13||? matches a single character|
|14||Excluding a field from the search|
Search for a term over the dataset in scope.
['sample-http-logs'] | search "image"
Search for records that match both terms in the dataset.
['sample-http-logs'] | search "jpeg" and ("GET" or "true")
Search for events that match both case-sensitive terms in the dataset.
['sample-http-logs'] | search kind=case_sensitive "css"
Search for a term in the “method” and “user_agent” fields in the dataset.
['sample-http-logs'] | search method:"GET" or user_agent :"Mozilla"
Search for a term over the dataset if the term appears in an event with a date greater than the given date.
['sample-http-logs'] | search "get" and _time > datetime('2022-09-16')
By default, the search is case-insensitive and uses the simple search.
['sample-http-logs'] | search kind=default "INDIA"
Search for logs that contain the term "text" with case sensitivity.
['sample-http-logs'] | search kind=case_sensitive "text"
Explicitly search for logs that contain the term "CSS" without case sensitivity.
['sample-http-logs'] | search kind=case_insensitive "CSS"
Search all logs. This would essentially return all rows in the dataset.
['sample-http-logs'] | search *
Search for logs that contain any substring of "brazil".
['sample-http-logs'] | search "*brazil*"
Search the logs for entries that contain either the term "GET" or "covina", irrespective of their context or the fields they appear in.
['sample-http-logs'] | search "GET" or "covina"
Avoid Overuse: For known schema and recurring queries, it's more efficient to use field-specific queries. Using broader queries with
searchcan be expensive and may not be suitable for dashboards or monitors unless fully understood.
Combine with other operators: After using the search operator to find the desired data, use other APL operators to refine, aggregate, and format results.
Use search kinds effectively: If you are aware of the pattern, make use of kind to specify if it's a