topic Event extraction from logs in DQL

Event extraction from logs

henk_stobbe — Wed, 25 Oct 2023 07:36:05 GMT

Hello,

As seen below, for event extraction in logs, not all DQL parts are valid:

Is there a rule of thumb what subset of DQL can be used?

Or am I missing something (-;

KR Henk

dannemca — Fri, 27 Oct 2023 20:38:04 GMT

Hi @henk_stobbe , the "//" is the comment section you can add in the DQL... it seems that it can not be used in the Log query there.

So you can use anything you normally do with DQL, but comments 😅

And you will need to edit it a bit... the '|' will become 'and', and the commands will not be required , for example the 'filter' can be removed.