topic Re: Putty grep command - DQL equivalent in DQL

Use DQL Equivalent of Putty Grep Command for Data Filtering

apanoobee — Wed, 17 Dec 2025 12:20:20 GMT

I am trying to translate this string to DQL and failing miserably. Can anyone help?

grep -i "exception" /data/this/will/be/the/folder/location/*.log | sort | uniq -c | sort -nr | head -n 10

Basically, anything that has the word "exception" in the log from the a folder location I would like to be able to view them in data explorer / dashboard / notebook.

Can anyone help me how to properly translate this to DQL?

Re: Putty grep command - DQL equivalent

t_pawlak — Wed, 19 Nov 2025 14:44:26 GMT

Hi,
try with this:

fetch logs | filter contains(content, "exception", caseSensitive:false) | filter contains(log.source, "/data/this/will/be/the/folder/location/") | summarize { cnt = count() }, by:{content} | sort cnt desc | limit 10

grep -i "exception" filter contains(content, "exception", caseSensitive:false)
*.log in a folder filter contains(log.source, "/data/.../")
uniq -c summarize { cnt = count() }, by:{content}
sort -nr sort cnt desc
head -n 10 limit 10

Re: Putty grep command - DQL equivalent

apanoobee — Wed, 19 Nov 2025 15:01:27 GMT

Thank you. I think I might have solved it by using:

fetch logs
| filter matchesValue(host.name, "#####.domain.net") AND matchesValue(log.source, "data/this/will/be/the/folder/location/*") AND matchesValue(content, "*exception*")
| sort timestamp desc
| limit 10