update underlines and bullet points

ritvibhatt · ritvibhatt · commit a422a2d850a7 · 2025-10-16T16:32:09.000-07:00
Signed-off-by: Ritvi Bhatt &lt;ribhatt@amazon.com&gt;
diff --git a/docs/user/ppl/cmd/append.rst b/docs/user/ppl/cmd/append.rst
@@ -1,6 +1,6 @@
-=========
+======
 append
-=========
+======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/bin.rst b/docs/user/ppl/cmd/bin.rst
@@ -1,6 +1,6 @@
-=============
+===
 bin
-=============
+===
 
 .. rubric:: Table of contents
 
@@ -33,9 +33,9 @@ bin <field> [span=<interval>] [minspan=<interval>] [bins=<count>] [aligntime=(ea
 * minspan: optional. The minimum interval size for automatic span calculation. Cannot be used with span or bins parameters.
 * bins: optional. The maximum number of equal-width bins to create. Cannot be used with span or minspan parameters. The bins parameter must be between 2 and 50000 (inclusive).
 * aligntime: optional. Align the bin times for time-based fields. Valid only for time-based discretization. Options:
-  - earliest: Align bins to the earliest timestamp in the data
-  - latest: Align bins to the latest timestamp in the data  
-  - <time-specifier>: Align bins to a specific epoch time value or time modifier expression
+    * earliest: Align bins to the earliest timestamp in the data
+    * latest: Align bins to the latest timestamp in the data  
+    * <time-specifier>: Align bins to a specific epoch time value or time modifier expression
 * start: optional. The starting value for binning range. **Default:** minimum field value.
 * end: optional. The ending value for binning range. **Default:** maximum field value.
 
diff --git a/docs/user/ppl/cmd/dedup.rst b/docs/user/ppl/cmd/dedup.rst
@@ -1,6 +1,6 @@
-=============
+=====
 dedup
-=============
+=====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/describe.rst b/docs/user/ppl/cmd/describe.rst
@@ -1,6 +1,6 @@
-=============
+========
 describe
-=============
+========
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/eval.rst b/docs/user/ppl/cmd/eval.rst
@@ -1,6 +1,6 @@
-=============
+====
 eval
-=============
+====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/eventstats.rst b/docs/user/ppl/cmd/eventstats.rst
@@ -1,6 +1,6 @@
-=============
+==========
 eventstats
-=============
+==========
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/expand.rst b/docs/user/ppl/cmd/expand.rst
@@ -1,6 +1,6 @@
-=============
+======
 expand
-=============
+======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/explain.rst b/docs/user/ppl/cmd/explain.rst
@@ -1,6 +1,6 @@
-=============
+=======
 explain
-=============
+=======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/fields.rst b/docs/user/ppl/cmd/fields.rst
@@ -1,6 +1,6 @@
-=============
+======
 fields
-=============
+======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/fillnull.rst b/docs/user/ppl/cmd/fillnull.rst
@@ -1,6 +1,6 @@
-=============
+========
 fillnull
-=============
+========
 
 .. rubric:: Table of contents
 
@@ -26,9 +26,9 @@ Syntax
 * field: mandatory when using ``using`` syntax. Individual field name to assign a specific replacement value.
 
 * **Syntax variations:**
-  * ``with <replacement> in <field-list>`` - Apply same value to specified fields
-  * ``using <field>=<replacement>, ...`` - Apply different values to different fields
-  * ``value=<replacement> [<field-list>]`` - Alternative syntax with optional space-delimited field list
+    * ``with <replacement> in <field-list>`` - Apply same value to specified fields
+    * ``using <field>=<replacement>, ...`` - Apply different values to different fields
+    * ``value=<replacement> [<field-list>]`` - Alternative syntax with optional space-delimited field list
 
 Example 1: Replace null values with a specified value on one field
 ==================================================================
diff --git a/docs/user/ppl/cmd/flatten.rst b/docs/user/ppl/cmd/flatten.rst
@@ -1,6 +1,6 @@
-=============
+=======
 flatten
-=============
+=======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/grok.rst b/docs/user/ppl/cmd/grok.rst
@@ -1,6 +1,6 @@
-=============
+====
 grok
-=============
+====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/head.rst b/docs/user/ppl/cmd/head.rst
@@ -1,6 +1,6 @@
-=============
+====
 head
-=============
+====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/join.rst b/docs/user/ppl/cmd/join.rst
@@ -1,6 +1,6 @@
-=============
+====
 join
-=============
+====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/lookup.rst b/docs/user/ppl/cmd/lookup.rst
@@ -1,6 +1,6 @@
-=============
+======
 lookup
-=============
+======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/multisearch.rst b/docs/user/ppl/cmd/multisearch.rst
@@ -1,6 +1,6 @@
-=============
+===========
 multisearch
-=============
+===========
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/parse.rst b/docs/user/ppl/cmd/parse.rst
@@ -1,6 +1,6 @@
-=============
+=====
 parse
-=============
+=====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/patterns.rst b/docs/user/ppl/cmd/patterns.rst
@@ -1,6 +1,6 @@
-=============
+========
 patterns
-=============
+========
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/rare.rst b/docs/user/ppl/cmd/rare.rst
@@ -1,6 +1,6 @@
-=============
+====
 rare
-=============
+====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/regex.rst b/docs/user/ppl/cmd/regex.rst
@@ -1,6 +1,6 @@
-=============
+=====
 regex
-=============
+=====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/rename.rst b/docs/user/ppl/cmd/rename.rst
@@ -1,6 +1,6 @@
-=============
+======
 rename
-=============
+======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/replace.rst b/docs/user/ppl/cmd/replace.rst
@@ -1,6 +1,6 @@
-=============
+=======
 replace
-=============
+=======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/reverse.rst b/docs/user/ppl/cmd/reverse.rst
@@ -1,6 +1,6 @@
-=============
+=======
 reverse
-=============
+=======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/rex.rst b/docs/user/ppl/cmd/rex.rst
@@ -1,6 +1,6 @@
-=============
+===
 rex
-=============
+===
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/search.rst b/docs/user/ppl/cmd/search.rst
@@ -1,6 +1,6 @@
-=============
+======
 search
-=============
+======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/sort.rst b/docs/user/ppl/cmd/sort.rst
@@ -1,6 +1,6 @@
-=============
+====
 sort
-=============
+====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/spath.rst b/docs/user/ppl/cmd/spath.rst
@@ -1,6 +1,6 @@
-=============
+=====
 spath
-=============
+=====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/stats.rst b/docs/user/ppl/cmd/stats.rst
@@ -1,6 +1,6 @@
-=============
+=====
 stats
-=============
+=====
 
 .. rubric:: Table of contents
 
@@ -25,16 +25,16 @@ stats [bucket_nullable=bool] <aggregation>... [by-clause]
     * When ``plugins.ppl.syntax.legacy.preferred=false``, ``bucket_nullable`` defaults to ``false``
 * by-clause: optional. Groups results by specified fields or expressions. Syntax: by [span-expression,] [field,]... **Default:** If no by-clause is specified, the stats command returns only one row, which is the aggregation over the entire result set.
 * span-expression: optional, at most one. Splits field into buckets by intervals. Syntax: span(field_expr, interval_expr). The unit of the interval expression is the natural unit by default. If the field is a date/time type field, the aggregation results always ignore null bucket. For example, ``span(age, 10)`` creates 10-year age buckets, ``span(timestamp, 1h)`` creates hourly buckets.
-  * Available time units:
-    * millisecond (ms)
-    * second (s)
-    * minute (m, case sensitive)
-    * hour (h)
-    * day (d)
-    * week (w)
-    * month (M, case sensitive)
-    * quarter (q)
-    * year (y)
+    * Available time units:
+        * millisecond (ms)
+        * second (s)
+        * minute (m, case sensitive)
+        * hour (h)
+        * day (d)
+        * week (w)
+        * month (M, case sensitive)
+        * quarter (q)
+        * year (y)
 
 Aggregation Functions
 =====================
diff --git a/docs/user/ppl/cmd/subquery.rst b/docs/user/ppl/cmd/subquery.rst
@@ -1,6 +1,6 @@
-=============
+========
 subquery
-=============
+========
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/syntax.rst b/docs/user/ppl/cmd/syntax.rst
@@ -1,6 +1,6 @@
-=============
+======
 Syntax
-=============
+======
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/table.rst b/docs/user/ppl/cmd/table.rst
@@ -1,6 +1,6 @@
-=============
+=====
 table
-=============
+=====
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/timechart.rst b/docs/user/ppl/cmd/timechart.rst
@@ -1,6 +1,6 @@
-=============
+=========
 timechart
-=============
+=========
 
 .. rubric:: Table of contents
 
@@ -19,29 +19,29 @@ Syntax
 timechart [span=<time_interval>] [limit=<number>] [useother=<boolean>] <aggregation_function> [by <field>]
 
 * span: optional. Specifies the time interval for grouping data. **Default:** 1m (1 minute).
-  * Available time units:
-    * millisecond (ms)
-    * second (s)
-    * minute (m, case sensitive)
-    * hour (h)
-    * day (d)
-    * week (w)
-    * month (M, case sensitive)
-    * quarter (q)
-    * year (y)
+    * Available time units:
+        * millisecond (ms)
+        * second (s)
+        * minute (m, case sensitive)
+        * hour (h)
+        * day (d)
+        * week (w)
+        * month (M, case sensitive)
+        * quarter (q)
+        * year (y)
 * limit: optional. Specifies the maximum number of distinct values to display when using the "by" clause. **Default:** 10.
-  * When there are more distinct values than the limit, the additional values are grouped into an "OTHER" category if useother is not set to false.
-  * The "most distinct" values are determined by calculating the sum of the aggregation values across all time intervals for each distinct field value. The top N values with the highest sums are displayed individually, while the rest are grouped into the "OTHER" category.
-  * Set to 0 to show all distinct values without any limit (when limit=0, useother is automatically set to false).
-  * The parameters can be specified in any order before the aggregation function.
-  * Only applies when using the "by" clause to group results.
+    * When there are more distinct values than the limit, the additional values are grouped into an "OTHER" category if useother is not set to false.
+    * The "most distinct" values are determined by calculating the sum of the aggregation values across all time intervals for each distinct field value. The top N values with the highest sums are displayed individually, while the rest are grouped into the "OTHER" category.
+    * Set to 0 to show all distinct values without any limit (when limit=0, useother is automatically set to false).
+    * The parameters can be specified in any order before the aggregation function.
+    * Only applies when using the "by" clause to group results.
 * useother: optional. Controls whether to create an "OTHER" category for values beyond the limit. **Default:** true.
-  * When set to false, only the top N values (based on limit) are shown without an "OTHER" column.
-  * When set to true, values beyond the limit are grouped into an "OTHER" category.
-  * Only applies when using the "by" clause and when there are more distinct values than the limit.
+    * When set to false, only the top N values (based on limit) are shown without an "OTHER" column.
+    * When set to true, values beyond the limit are grouped into an "OTHER" category.
+    * Only applies when using the "by" clause and when there are more distinct values than the limit.
 * aggregation_function: mandatory. The aggregation function to apply to each time bucket.
-  * Currently, only a single aggregation function is supported.
-  * Available functions: All aggregation functions supported by the :doc:`stats <stats>` command, as well as the timechart-specific aggregations listed below.
+    * Currently, only a single aggregation function is supported.
+    * Available functions: All aggregation functions supported by the :doc:`stats <stats>` command, as well as the timechart-specific aggregations listed below.
 * by: optional. Groups the results by the specified field in addition to time intervals. If not specified, the aggregation is performed across all documents in each time interval.
 
 PER_SECOND
diff --git a/docs/user/ppl/cmd/top.rst b/docs/user/ppl/cmd/top.rst
@@ -1,6 +1,6 @@
-=============
+===
 top
-=============
+===
 
 .. rubric:: Table of contents
 
diff --git a/docs/user/ppl/cmd/trendline.rst b/docs/user/ppl/cmd/trendline.rst
diff --git a/docs/user/ppl/cmd/where.rst b/docs/user/ppl/cmd/where.rst
