![]() The like function supports several syntaxes, see Comparison and Conditional functions.ĥ. However you can use the like function to perform a wildcard search. The WHERE clause does not support the wildcard character ( * ). You can use a wildcard to search for only internal fields, which begin with an underscore ( _ ) character. You must enclose the wildcard syntax in single quotation marks. You can use a wildcard character ( * ) in the SELECT clause to search for similar field names. The following search looks for data in the EMEA and APAC indexes: See Comparison and Conditional functions. ![]() To use a wildcard in the WHERE clause, you cannot use the asterisk ( * ) wildcard character. SELECT earliest_time(_value), metric_name The following search looks for data in the _metrics index: For example, the previous search can also be specified this way:įROM my_index "syslog"=sourcetype. The following search shows that string values in field-value pairs must be enclosed in double quotation marks.īecause string values must be enclosed in double quotation marks, you can reverse the order of field-value pairs. Both of these clauses are valid syntax for the from command. ![]() Some of these examples start with the SELECT clause and others start with the FROM clause. These examples use uppercase for readability. You can specify the clauses in the from command in uppercase or lowercase. To learn more about the from command, see How the from command works. The following are examples for using the SPL2 from command.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |