_sourceName=*service*
_sourceName=*service*env_name
... | json auto | json auto field=message
... | WHERE field_name = <value>
... | WHERE !(field_name = null)
... | number(duration)
... | round(duration / 1000) as duration_secs
... | avg(field) or ... | avg(field1) as field1, avg(field2) as field2 when multiple
... | pct(field, 50, 95, 99)
Shows avg(field) in 15 minutes timeslices grouped by day over the past 8 days
... | timeslice 15m | avg(field) by _timeslice | compare with timeshift 1d 8
Graphs count(status, path, _timeslice) with the X axis = timeslice and Y axis = count, with one line per unique (status, path)
... | timeslice 5m | count by status, path, _timeslice | transpose row _timeslice column path, status
... | count by field1, field2
Number of backslashes in regex = (2 * number_of_backslashes_in_message) + 1
... | where contains(field, "str")
... | split <field> delim='/' extract 4 as <name>