This page explains how to use the search operator in APL.
search
operator in APL is used to perform a full-text search across multiple fields in a dataset. This operator allows you to locate specific keywords, phrases, or patterns, helping you filter data quickly and efficiently. You can use search
to query logs, traces, and other data sources without the need to specify individual fields, making it particularly useful when you’re unsure where the relevant data resides.
Use search
when you want to search multiple fields in a dataset, especially for ad-hoc analysis or quick lookups across logs or traces. It’s commonly applied in log analysis, security monitoring, and trace analysis, where multiple fields may contain the desired data.
Name | Type | Required | Description |
---|---|---|---|
CaseSensitivity | string | A flag that controls the behavior of all string scalar operators, such as has , with respect to case sensitivity. Valid values are default , case_insensitive , case_sensitive . The options default and case_insensitive are synonymous, since the default behavior is case insensitive. | |
SearchPredicate | string | ✓ | A Boolean expression to be evaluated for every event in the input. If it returns true , the record is outputted. |
Literal | Operator |
---|---|
axiomk | has |
*axiomk | hassuffix |
axiomk* | hasprefix |
*axiomk* | contains |
ax*ig | matches regex |
Syntax | Explanation |
---|---|
FieldName: StringLiteral | This syntax can be used to restrict the search to a specific field. The default behavior is to search all fields. |
FieldName== StringLiteral | This syntax can be used to search for exact matches of a field against a string value. The default behavior is to look for a term-match. |
Field matches regex StringLiteral | This syntax indicates regular expression matching, in which StringLiteral is the regex pattern. |
"axiom" and b==789
would result in a search for events that have the term axiom in any field and the value 789 in the b field.
# | Syntax | Meaning (equivalent where ) | Comments |
---|---|---|---|
1 | search "axiom" | where * has "axiom" | |
2 | search field:"axiom" | where field has "axiom" | |
3 | search field=="axiom" | where field=="axiom" | |
4 | search "axiom*" | where * hasprefix "axiom" | |
5 | search "*axiom" | where * hassuffix "axiom" | |
6 | search "*axiom*" | where * contains "axiom" | |
7 | search "Pad*FG" | where * matches regex @"\bPad.*FG\b" | |
8 | search * | where 0==0 | |
9 | search field matches regex "..." | where field matches regex "..." | |
10 | search kind=case_sensitive | All string comparisons are case-sensitive | |
11 | search "axiom" and ("log" or "metric") | where * has "axiom" and (* has "log" or * has "metric") | |
12 | search "axiom" or (A>a and A<b) | where * has "axiom" or (A>a and A<b) | |
13 | search "AxI?OM" | where * matches regex @"\bAxI.OM\b" | ? matches a single character |
14 | search "axiom" and not field:"error" | where * has "axiom" and not field has "error" | Excluding a field from the search |
method
and user_agent
fields in the dataset.
search
operator has an impact on performance, especially when used over a high volume of events in a wide time range. To use the search
operator efficiently, follow these guidelines:
search
operator, that narrow your query results by searching across all fields for a given value. When you know the target field, replace the search
operator with where
clauses that filter for values in a specific field.search
operator in your query, use other operators, such as project
statements, to limit the number of returned fields.kind
flag when possible. When you know the pattern that string values in your data follow, use the kind
flag to specify the case-sensitivity of the search.