is possible to create a dataset with uppercase characters in its
name, but when creating a query, the dataset name only uses lowercase
To streamline your investigations, the XQL search
provides the following aids to help you construct and visualize
query—The XQL query field is where you define the parameters of
your query. To help you create
an effective XQL query, the search field provides suggestions
and definitions as you type.
Translate to XQL
— Converts your existing
Splunk queries to the XQL syntax. When building your XQL query and
you move the toggle to Translate to XQL,
are displayed, so you can easily add a Splunk query, which is converted
to XQL in the XQL query field. This option is disabled by default,
so only the XQL query field is displayed.
—After you create and
run an XQL query, you can view, filter, and visualize your
—Describes common stage
commands and provides of examples that you can use to build a query.
—Contains common, predefined
queries that you can use or modify to your liking. In addition,
Query Library for saving and managing your own queries that you can
also share with others, and queries shared with you.
information for every field found in the result set. This information
includes the field name, data type, descriptive text (if available),
and the dataset that contains the field. In order for a field to
appear in the
tab, it must contain
a non-NULL value at least once in the result set.
In the XQL, every user field included in the
raw data, for network, authentication, and login events, has an
equivalent normalized user field associated with it that displays
the user information in the following standardized format:
For example, the
to display the content in the standardized format. We recommend
that you use these
when building your queries to ensure the most accurate results.