Event extraction from logs

[henk_stobbe]

Hello,

As seen below, for event extraction in logs, not all DQL parts are valid:

Is there a rule of thumb what subset of DQL can be used?

Or am I missing something (-;

KR Henk

[dannemca · Accepted solution]

Hi @henk_stobbe , the "//" is the comment section you can add in the DQL... it seems that it can not be used in the Log query there.

So you can use anything you normally do with DQL, but comments 😅

And you will need to edit it a bit... the '|' will become 'and', and the commands will not be required , for example the 'filter' can be removed.