github.com/siglens/siglens@v0.0.0-20240328180423-f7ce9ae441ed/cicd/sample_log_dataset_queries.csv (about) 1 *,now-1d,now,*,total,gt,500,Pipe QL 2 app_name=Zebracould,now-1d,now,*,total,gt,0,Pipe QL 3 batch=batch-*,now-1d,now,*,total,gt,100,Pipe QL 4 min(zip) groupby batch,now-1d,now,*,total,,100,Pipe QL 5 Sunday,now-1d,now,*,total,gt,1,Pipe QL 6 arvidlesch@hilll.org,now-1d,now,*,total,gt,0,Pipe QL 7 http_status>400,now-1d,now,*,total,gt,0,Pipe QL 8 cardinality(user_email),now-1d,now,total,*,,1,Pipe QL 9 """https://picsum.photos/130/268""",now-1d,now,*,total,gt,0,Pipe QL 10 latency<9539889 AND app_name=Koalahad,now-1d,now,*,total,gt,0,Pipe QL 11 """MintCream""",now-1d,now,*,total,gt,100,Pipe QL 12 "(MintCream AND (""Thursday"" OR ""Monday""))",now-1d,now,*,total,gt,20,Pipe QL 13 "(MintCream AND (""Thursday"" OR ""Monday"")) | min(latency) groupby state",now-1d,now,*,total,gt,20,Pipe QL 14 latency<10000 AND latitude>0 AND longitude > 0,now-1d,now,*,total,gt,10,Pipe QL 15 Wisconsin,now-1d,now,*,total,gt,100,Pipe QL 16 Arizona OR Maine,now-1d,now,*,total,gt,100,Pipe QL 17 min(latency),now-1d,now,*,group:min(latency):*,eq,"2,837",Pipe QL 18 "min(latency) groupby city, http_method",now-1d,now,*,group:min(latency):Boston:POST,eq,655449,Pipe QL 19 "select batch as bt",now-1d,now,*,total,gt,100,SQL 20 "select weekday",now-1d,now,*,total,gt,1,SQL 21 "select gender as bt, city as `ct` from sample-log-dataset",now-1d,now,*,total,gt,0,SQL 22 "select batch as bt order by batch",now-1d,now,*,total,gt,100,SQL 23 "select batch as bt order by batch desc",now-1d,now,*,total,gt,100,SQL 24 "select batch as bt order by batch asc",now-1d,now,*,total,gt,100,SQL 25 "{app_name=""Zebracould""}",now-1d,now,*,total,gt,0,Log QL 26 "{batch=""batch-*""}",now-1d,now,*,total,gt,100,Log QL 27 "{weekday=""Sunday""} |= ""Sunday""",now-1d,now,*,total,gt,1,Log QL 28 "{batch=""batch-*""} | json",now-1d,now,*,total,gt,100,Log QL 29 "{gender=""female""} | http_status>400",now-1d,now,*,total,gt,0,Log QL 30 "{gender=""female"",city=""Fresno""} != ""batch-212""",now-1d,now,*,total,gt,100,Log QL 31 "{weekday=""Sunday""} | json",now-1d,now,*,total,gt,1,Log QL 32 "{gender=""female"",city=""Fresno""} | json city_life=""city"", single_gender=""gender""",now-1d,now,*,total,gt,100,Log QL 33 "{gender=""female"",city=""Fresno""} | logfmt city_life=""city"", single_gender=""gender""",now-1d,now,*,total,gt,100,Log QL 34 "{weekday=""Sunday""} | logfmt",now-1d,now,*,total,gt,1,Log QL 35 "count_over_time({batch=""batch-*""}[1d])", now-1d,now,*,total,gt,100,Log QL 36 app_name=Zebracould,now-1d,now,*,total,gt,0,Splunk QL 37 search app_name=Zebracould,now-1d,now,*,total,gt,0,Splunk QL 38 search Sunday,now-1d,now,*,total,gt,1,Splunk QL 39 search http_status>400,now-1d,now,*,total,gt,0,Splunk QL 40 "search Norway",now-1d,now,*,total,gt,100,Splunk QL 41 "search GET OR PUT",now-1d,now,*,total,gt,100,Splunk QL 42 search latency<25000 AND app_name=Zebracould,now-1d,now,*,total,eq,0,Splunk QL 43 search MintCream AND Thursday OR Monday,now-1d,now,*,total,eq,40,Splunk QL 44 search (MintCream AND Thursday) OR Monday,now-1d,now,*,total,gt,30,Splunk QL 45 search ( MintCream AND Thursday ) OR Monday,now-1d,now,*,total,gt,212,Splunk QL 46 search MintCream Thursday OR Monday,now-1d,now,*,total,eq,40,Splunk QL 47 search NOT (city!=Boston OR NOT weekday=Friday),now-1d,now,*,total,gt,99,Splunk QL 48 search batch=batch-*,now-1d,now,*,total,gt,100,Splunk QL 49 latency<10000 | search latitude>0 | search longitude>0,now-1d,now,*,total,gt,10,Splunk QL 50 latency<10000 | latitude>0 | search longitude>0,now-1d,now,*,total,gt,10,Splunk QL 51 "search batch=batch-* | regex city=""^[A-L][a-z]+\s[a-zA-Z]+$""",now-1d,now,*,total,gt,5,Splunk QL 52 "search batch=batch-* | regex city!=""^[A-L][a-z]+\s[a-zA-Z]+$""",now-1d,now,*,total,gt,50,Splunk QL 53 batch=batch-10 | stats count,now-1d,now,*,group:count(*):*,eq,60,Splunk QL 54 batch=batch-10 | stats count(http_method),now-1d,now,*,group:count(http_method):*,eq,60,Splunk QL 55 batch=batch-10 | stats distinct_count(http_method),now-1d,now,*,group:cardinality(http_method):*,eq,3,Splunk QL 56 city=Boston | stats min(latitude),now-1d,now,*,group:min(latitude):*,eq,-81.826,Splunk QL 57 city=Boston | stats max(latitude),now-1d,now,*,group:max(latitude):*,eq,69.564,Splunk QL 58 city=Boston | stats range(latitude),now-1d,now,*,group:range(latitude):*,eq,151.390,Splunk QL 59 city=Boston | stats avg(latitude),now-1d,now,*,group:avg(latitude):*,eq,7.845,Splunk QL 60 city=Boston | stats sum(latitude),now-1d,now,*,group:sum(latitude):*,eq,"2,196.704",Splunk QL 61 city=Boston | stats values(gender),now-1d,now,*,group:values(gender):*,eq,"female male",Splunk QL 62 "batch=batch-10 | stats count, min(latitude), max(latitude)",now-1d,now,*,group:max(latitude):*,eq,-62.278,Splunk QL 63 batch=batch-10 | stats count BY city,now-1d,now,*,group:count(*):Fresno,eq,20,Splunk QL 64 "batch=batch-10 | stats count BY city, http_status",now-1d,now,*,group:count(*):Fresno:302,eq,20,Splunk QL 65 "PUT | fields city, weekday",now-1d,now,*,total,gt,100,Splunk QL 66 "Friday | ```Only keep city and weekday columns``` fields city, weekday",now-1d,now,*,total,gt,100,Splunk QL 67 "Senior | fields http*",now-1d,now,*,total,gt,100,Splunk QL 68 city=Boston | stats count AS Count BY weekday,now-1d,now,*,group:Count:Monday,eq,40,Splunk QL 69 city=Boston | stats count AS Count BY weekday | eval Append123=Count . 123, now-1d,now,*,group:Append123:Monday,eq,40123,Splunk QL 70 city=Boston | stats count AS Count BY zip | eval Summary=Count . zip, now-1d,now,*,group:Summary:70354,eq,2070354,Splunk QL 71 city=Boston | stats count AS Count BY zip | eval Average=(Count + zip) / 2,now-1d,now,*,group:Average:57405,eq,28712.5,Splunk QL 72 city=Boston | stats count AS Count BY http_status | eval abs=abs(http_status - 1000),now-1d,now,*,group:abs:302,eq,698,Splunk QL 73 city=Boston | stats count AS Count BY weekday | eval ceil=ceil(Count + 0.1),now-1d,now,*,group:ceil:Monday,eq,41,Splunk QL 74 city=Detroit | stats count AS Count BY latitude | where latitude > 50.1 | eval round=round(latitude),now-1d,now,*,group:round:58.468491,eq,58,Splunk QL 75 city = Detroit | stats count AS Count BY latitude | where latitude> 50.1 | eval round = round( latitude),now-1d,now,*,group:round:57.68665,eq,58,Splunk QL 76 "city=Detroit | stats count AS Count BY latitude | where latitude > 89.6 | eval round=round(latitude, 3)",now-1d,now,*,group:round:56.468491,eq,58.468,Splunk QL 77 city=Columbus | stats count AS Count BY http_status | eval sqrt=sqrt(http_status + 200),now-1d,now,*,group:sqrt:200,eq,20,Splunk QL 78 city=Boston | stats count AS Count BY app_name | eval len=len(app_name) | where len > 22,now-1d,now,*,group:len:LightGoldenRodYellowsalt,eq,24,Splunk QL 79 "city=Boston | stats count AS Count BY state | eval myField=""Test concat:"" . lower(state) . "" end""",now-1d,now,*,group:myField:Texas,eq,Test concat:texas end,Splunk QL 80 "city=Boston | stats count AS Count BY state | eval myField=ltrim(state, ""Mo"") . "" test end""",now-1d,now,*,group:myField:Montana,eq,ntana test end,Splunk QL 81 "city=Boston | stats count AS Count BY state | eval myField=""test "" . "" start:"" . rtrim(state, ""nt"")",now-1d,now,*,group:myField:Vermont,eq,test start:Vermo,Splunk QL 82 "city=Boston | stats count AS Count BY http_status | eval myField=if(http_status > 400, http_status + 10, ""Error"")",now-1d,now,*,group:myField:500,eq,510,Splunk QL 83 "city=Boston | stats count AS Count BY http_status | eval myField=if(http_status > 400, http_status, ""Error"")",now-1d,now,*,group:myField:400,eq,Error,Splunk QL 84 "city=Boston | stats count AS Count BY http_status | where http_status in(404, 301, ""abc"")",now-1d,now,*,total,eq,280,Splunk QL 85 "city=Boston | stats count AS Count BY state | eval myField=if(in(state, ""Ala"" . ""bama"", ""Hawaii"", 99 + 1), state . "" Success"", ""Error"")",now-1d,now,*,group:myField:Nevada,eq,Error,Splunk QL 86 "city=Boston | stats count AS Count BY country | eval result=if(isstr(country), ""This is a string"", ""This is not a string"")",now-1d,now,*,group:result:Afghanistan,eq,This is a string,Splunk QL 87 "city=Boston | stats count AS Count BY http_status | eval result=if(isint(http_status), ""This is an integer"", ""This is not an integer"")",now-1d,now,*,group:result:500,eq,This is an integer,Splunk QL 88 "city=Boston | stats count AS Count BY city | eval result=if(isbool(city), ""This is a boolean value"", ""This is not a boolean value"")",now-1d,now,*,group:result:Boston,eq,This is not a boolean value,Splunk QL 89 "city=Boston | stats count AS Count BY state | eval result=if(isnull(state), ""This is a null value"", ""This is not a null value"")",now-1d,now,*,group:result:Maine,eq,This is not a null value,Splunk QL 90 "city=Boston | stats count AS Count BY http_status | eval result=urldecode(""http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fr%3Dheader"")",now-1d,now,*,group:result:500,eq,"http://www.splunk.com/download?r=header",Splunk QL 91 "city=Boston | stats count AS Count BY ident | eval result=split(ident,""-"")",now-1d,now,*,group:result:5e5596e5-8d48-446b-a8bb-1f26d22350e2,eq,5e5596e5 8d48 446b a8bb 1f26d22350e2,Splunk QL 92 "city=Boston | stats count AS Count BY http_status | eval result=max(1, 3, 450, http_status)",now-1d,now,*,group:result:200,eq,450,Splunk QL 93 "city=Boston | stats count AS Count BY http_status | eval result=min(1, 3, 450, http_status)",now-1d,now,*,group:result:200,eq,1,Splunk QL 94 "city=Boston | stats count AS Count BY http_status | eval result=exact(3.14 * http_status)",now-1d,now,*,group:result:200,eq,628,Splunk QL 95 "city=Boston | stats count AS Count BY http_status | eval result=exp(3)",now-1d,now,*,group:result:200,eq,20.085536923187668,Splunk QL 96 "city=Boston | stats count AS Count BY http_status | eval result=if(like(http_status, ""4%""), ""True"", ""False"")",now-1d,now,*,group:result:400,eq,True,Splunk QL 97 "city=Boston | stats count AS Count BY country | eval result=if(match(country, ""^Ne""), ""yes"", ""no"")",now-1d,now,*,group:result:Netherlands,eq,yes,Splunk QL 98 "city=Boston | stats count AS Count BY http_status | eval result=if(cidrmatch(""192.0.2.0/24"", ""192.0.2.5""), ""local"", ""not local"")",now-1d,now,*,group:result:200,eq,local,Splunk QL 99 "city=Boston | stats count AS Count BY state | eval result=substr(""splendid"", 1, 3) . substr(""chunk"", -3)",now-1d,now,*,group:result:Maine,eq,splunk,Splunk QL 100 "city=Boston | stats count AS Count BY state | eval result=tonumber(""0A4"",16)",now-1d,now,*,group:result:Maine,eq,164,Splunk QL 101 "city=Boston | stats count AS Count BY state | eval result=tostring((2 > 1))",now-1d,now,*,group:result:Maine,eq,true,Splunk QL 102 "city=Boston | stats count AS Count BY state | eval result=tostring(15,""hex"")",now-1d,now,*,group:result:Maine,eq,0xf,Splunk QL 103 "city=Boston | stats count AS Count BY state | eval result=tostring(12345.6789,""commas"")",now-1d,now,*,group:result:Maine,eq,"12,345.68",Splunk QL 104 "city=Boston | stats count AS Count BY state | eval result=tostring(615,""duration"")",now-1d,now,*,group:result:Maine,eq,00:10:15,Splunk QL 105 "city=Boston | stats count AS Count BY weekday | rex field=weekday ""(?<first>.{3})(?<second>.*)""",now-1d,now,*,group:first:Friday,eq,Fri,Splunk QL 106 "city=Boston | stats count AS Count BY http_status | rex field=http_status ""(?<first>\d)(?<second>\d)(?<third>\d)""",now-1d,now,*,group:third:404,eq,4,Splunk QL 107 "city=Boston | rare country useother=true otherstr=testOther percentfield=pc countfield=ct showperc=false",now-1d,now,*,group:ct:Romania,eq,20,Splunk QL 108 "city=Boston | stats count AS gg BY state | top 10 state useother=true countfield=true percentfield=percent",now-1d,now,*,group:percent:Nevada,eq,7.142857,Splunk QL 109 "city=Boston | stats count AS Count BY http_method | rename http_method AS ""test""",now-1d,now,*,group:Count:POST,eq,60,Splunk QL 110 "city=Boston | stats count AS Count BY http_status, http_method | eval newField=(http_status - 1000) | rename newField AS http_method",now-1d,now,*,group:http_method:400,eq,-600,Splunk QL 111 city=Boston | stats count AS Count BY http_method | eval newField=lower(http_method) | rename new* AS start*end,now-1d,now,*,group:startFieldend:PATCH,eq,patch,Splunk QL 112 "city=Boston | stats max(latitude), range(eval(latitude >= 0)) AS range",now-1d,now,*,group:range:*,eq,66.417,Splunk QL 113 "* | stats count(eval(latitude < 0)) AS count, dc(eval(lower(app_name)))",now-1d,now,*,group:count:*,eq,"19,300",Splunk QL 114 "* | stats min(eval(latitude < 0)), max(eval(latitude < 0)) AS max, range(eval(latitude < 0)) BY weekday",now-1d,now,*,group:max:Monday,eq,-0.102292,Splunk QL 115 "app_name=""Troutcut"" (Wednesday OR Friday)",now-1d,now,*,total,eq,20,Splunk QL 116 "app_name=""Troutcut"" (Wednesday OR Friday) NOT asdfjklnvwer",now-1d,now,*,total,eq,20,Splunk QL