Putty grep command - DQL equivalent

[apanoobee]

I am trying to translate this string to DQL and failing miserably. Can anyone help?

grep -i "exception" /data/this/will/be/the/folder/location/*.log | sort | uniq -c | sort -nr | head -n 10

Basically, anything that has the word "exception" in the log from the a folder location I would like to be able to view them in data explorer / dashboard / notebook.

Can anyone help me how to properly translate this to DQL?

[t_pawlak]

Hi,
try with this:

fetch logs
| filter contains(content, "exception", caseSensitive:false)
| filter contains(log.source, "/data/this/will/be/the/folder/location/")
| summarize { cnt = count() }, by:{content}
| sort cnt desc
| limit 10

grep -i "exception" filter contains(content, "exception", caseSensitive:false)
*.log in a folder filter contains(log.source, "/data/.../")
uniq -c summarize { cnt = count() }, by:{content}
sort -nr sort cnt desc
head -n 10 limit 10

[apanoobee]

Thank you. I think I might have solved it by using:

fetch logs
| filter matchesValue(host.name, "#####.domain.net") AND matchesValue(log.source, "data/this/will/be/the/folder/location/*") AND matchesValue(content, "*exception*")
| sort timestamp desc
| limit 10