Skip to content

Commit b159bb4

Browse files
bwrenbwren
committed
Code reformatting
1 parent d537710 commit b159bb4

File tree

1 file changed

+24
-24
lines changed

1 file changed

+24
-24
lines changed

‎articles/log-analytics/query-language/splunk-cheatsheet.md

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -74,17 +74,17 @@ In Splunk, you can omit the `search` keyword and specify an unquoted string. In
7474

7575
| | | |
7676
|:---|:---|:---|
77-
| Splunk | **search** | `search Session.Id="c8894ffd-e684-43c9-9125-42adc25cd3fc" earliest=-24h` |
78-
| Log Analytics | **find** | `find Session.Id=="c8894ffd-e684-43c9-9125-42adc25cd3fc" and ingestion_time()> ago(24h)` |
77+
| Splunk | **search** | <code>search Session.Id="c8894ffd-e684-43c9-9125-42adc25cd3fc" earliest=-24h</code> |
78+
| Log Analytics | **find** | <code>find Session.Id=="c8894ffd-e684-43c9-9125-42adc25cd3fc" and ingestion_time()> ago(24h)</code> |
7979
| | |
8080

8181
### Filter
8282
Azure Log Analytics queries start from a tabular result set where the filter. In Splunk, filtering is the default operation on the current index. You can also use `where` operator in Splunk, but it is not recommended.
8383

8484
| | | |
8585
|:---|:---|:---|
86-
| Splunk | **search** | `Event.Rule="330009.2" Session.Id="c8894ffd-e684-43c9-9125-42adc25cd3fc" _indextime>-24h` |
87-
| Log Analytics | **where** | `Office_Hub_OHubBGTaskError`<br>&#124; `where Session_Id == "c8894ffd-e684-43c9-9125-42adc25cd3fc" and ingestion_time() > ago(24h)` |
86+
| Splunk | **search** | <code>Event.Rule="330009.2" Session.Id="c8894ffd-e684-43c9-9125-42adc25cd3fc" _indextime>-24h</code> |
87+
| Log Analytics | **where** | <code>Office_Hub_OHubBGTaskError<br>&#124; where Session_Id == "c8894ffd-e684-43c9-9125-42adc25cd3fc" and ingestion_time() > ago(24h)</code> |
8888
| | |
8989

9090

@@ -93,8 +93,8 @@ Azure Log Analytics also supports `take` as an alias to `limit`. In Splunk, if t
9393

9494
| | | |
9595
|:---|:---|:---|
96-
| Splunk | **head** | `Event.Rule=330009.2`<br>&#124; `head 100` |
97-
| Log Analytics | **limit** | `Office_Hub_OHubBGTaskError`<br>&#124; `limit 100` |
96+
| Splunk | **head** | <code>Event.Rule=330009.2<br>&#124; head 100<code> |
97+
| Log Analytics | **limit** | <code>Office_Hub_OHubBGTaskError<br>&#124; limit 100</code> |
9898
| | |
9999

100100

@@ -104,8 +104,8 @@ For bottom results, in Splunk you use `tail`. In Azure Log Analytics you can spe
104104

105105
| | | |
106106
|:---|:---|:---|
107-
| Splunk | **head** | `Event.Rule="330009.2"`<br>&#124; `sort Event.Sequence`<br>&#124; `head 20` |
108-
| Log Analytics | **top** | `Office_Hub_OHubBGTaskError`<br>&#124; `top 20 by Event_Sequence` |
107+
| Splunk | **head** | <code>Event.Rule="330009.2"`<br>&#124; `sort Event.Sequence<br>&#124; head 20</code> |
108+
| Log Analytics | **top** | <code>Office_Hub_OHubBGTaskError<br>&#124; top 20 by Event_Sequence</code> |
109109
| | |
110110

111111

@@ -116,8 +116,8 @@ Splunk also has an `eval` function, which is not to be comparable with the `eval
116116

117117
| | | |
118118
|:---|:---|:---|
119-
| Splunk | **eval** | `Event.Rule=330009.2`<br>&#124; `eval state= if(Data.Exception = "0", "success", "error")` |
120-
| Log Analytics | **extend** | `Office_Hub_OHubBGTaskError`<br>&#124; `extend state = iif(Data_Exception == 0,"success" ,"error")` |
119+
| Splunk | **eval** | <code>Event.Rule=330009.2<br>&#124; eval state= if(Data.Exception = "0", "success", "error")</code> |
120+
| Log Analytics | **extend** | <code>Office_Hub_OHubBGTaskError<br>&#124; extend state = iif(Data_Exception == 0,"success" ,"error")</code> |
121121
| | |
122122

123123

@@ -126,8 +126,8 @@ Azure Log Analytics uses the same operator to rename and to create a new field.
126126

127127
| | | |
128128
|:---|:---|:---|
129-
| Splunk | **rename** | `Event.Rule=330009.2`<br>&#124; `rename Date.Exception as execption` |
130-
| Log Analytics | **extend** | `Office_Hub_OHubBGTaskError`<br>&#124; `extend execption = Date_Exception` |
129+
| Splunk | **rename** | <code>Event.Rule=330009.2<br>&#124; rename Date.Exception as execption</code> |
130+
| Log Analytics | **extend** | <code>Office_Hub_OHubBGTaskError<br>&#124; extend execption = Date_Exception</code> |
131131
| | |
132132

133133

@@ -138,8 +138,8 @@ Splunk does not seem to have an operator similar to `project-away`. You can use
138138

139139
| | | |
140140
|:---|:---|:---|
141-
| Splunk | **table** | `Event.Rule=330009.2`<br>&#124; `table rule, state` |
142-
| Log Analytics | **project**<br>**project-away** | `Office_Hub_OHubBGTaskError`<br>&#124; `project exception, state` |
141+
| Splunk | **table** | <code>Event.Rule=330009.2<br>&#124; table rule, state</code> |
142+
| Log Analytics | **project**<br>**project-away** | <code>Office_Hub_OHubBGTaskError<br>&#124; project exception, state</code> |
143143
| | |
144144

145145

@@ -149,8 +149,8 @@ See the [Aggregations in Log Analytics queries](aggregations.md) for the differe
149149

150150
| | | |
151151
|:---|:---|:---|
152-
| Splunk | **stats** | `search (Rule=120502.*)`<br>&#124; `stats count by OSEnv, Audience` |
153-
| Log Analytics | **summarize** | `Office_Hub_OHubBGTaskError`<br>&#124; `summarize count() by App_Platform, Release_Audience` |
152+
| Splunk | **stats** | <code>search (Rule=120502.*)<br>&#124; stats count by OSEnv, Audience</code> |
153+
| Log Analytics | **summarize** | <code>Office_Hub_OHubBGTaskError<br>&#124; summarize count() by App_Platform, Release_Audience</code> |
154154
| | |
155155

156156

@@ -160,8 +160,8 @@ Join in Splunk has significant limitations. The subquery has a limit of 10000 re
160160

161161
| | | |
162162
|:---|:---|:---|
163-
| Splunk | **join** | `Event.Rule=120103* | stats by Client.Id, Data.Alias | join Client.Id max=0 [search earliest=-24h Event.Rule="150310.0" Data.Hresult=-2147221040]` |
164-
| Log Analytics | **join** | `cluster("OAriaPPT").database("Office PowerPoint").Office_PowerPoint_PPT_Exceptions`<br>&#124; `where Data_Hresult== -2147221040`<br>&#124; `join kind = inner (Office_System_SystemHealthMetadata`<br>&#124; `summarize by Client_Id, Data_Alias)on Client_Id` |
163+
| Splunk | **join** | <code>Event.Rule=120103* &#124; stats by Client.Id, Data.Alias | join Client.Id max=0 [search earliest=-24h Event.Rule="150310.0" Data.Hresult=-2147221040]</code> |
164+
| Log Analytics | **join** | <code>cluster("OAriaPPT").database("Office PowerPoint").Office_PowerPoint_PPT_Exceptions<br>&#124; where Data_Hresult== -2147221040<br>&#124; join kind = inner (Office_System_SystemHealthMetadata<br>&#124; summarize by Client_Id, Data_Alias)on Client_Id</code> |
165165
| | |
166166

167167

@@ -171,8 +171,8 @@ In Splunk, to sort in ascending order you must use the `reverse` operator. Azure
171171

172172
| | | |
173173
|:---|:---|:---|
174-
| Splunk | **sort** | `Event.Rule=120103`<br>&#124; `sort Data.Hresult`<br>&#124; `reverse` |
175-
| Log Analytics | **order by** | `Office_Hub_OHubBGTaskError`<br>&#124; `order by Data_Hresult, desc` |
174+
| Splunk | **sort** | <code>Event.Rule=120103<br>&#124; sort Data.Hresult<br>&#124; reverse</code> |
175+
| Log Analytics | **order by** | <code>Office_Hub_OHubBGTaskError<br>&#124; order by Data_Hresult, desc</code> |
176176
| | |
177177

178178

@@ -194,8 +194,8 @@ In the Log Analytics portal, only the first column is exposed. All columns are a
194194

195195
| | | |
196196
|:---|:---|:---|
197-
| Splunk | **fields** | `Event.Rule=330009.2`<br>&#124; `fields App.Version, App.Platform` |
198-
| Log Analytics | **facets** | `Office_Excel_BI_PivotTableCreate`<br>&#124; `facet by App_Branch, App_Version` |
197+
| Splunk | **fields** | <code>Event.Rule=330009.2<br>&#124; fields App.Version, App.Platform</code> |
198+
| Log Analytics | **facets** | <code>Office_Excel_BI_PivotTableCreate<br>&#124; facet by App_Branch, App_Version</code> |
199199
| | |
200200

201201

@@ -206,8 +206,8 @@ You can use `summarize arg_min()` instead to reverse the order of which record g
206206

207207
| | | |
208208
|:---|:---|:---|
209-
| Splunk | **dedup** | `Event.Rule=330009.2`<br>&#124; `dedup device_id sortby -batterylife` |
210-
| Log Analytics | **summarize arg_max()** | `Office_Excel_BI_PivotTableCreate`<br>&#124; `summarize arg_max(batterylife, *) by device_id` |
209+
| Splunk | **dedup** | <code>Event.Rule=330009.2<br>&#124; dedup device_id sortby -batterylife</code> |
210+
| Log Analytics | **summarize arg_max()** | <code>Office_Excel_BI_PivotTableCreate<br>&#124; summarize arg_max(batterylife, *) by device_id</code> |
211211
| | |
212212

213213

0 commit comments

Comments
 (0)