https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355306#M5693 <P>How can this sql "like" query be translated into something the Splunk search language can understand? </P> <P>select count(*) from LOG start from X time till Y time<BR /> select uniquecount(deviceGUID) from LOG start from X time till Y time <BR /> "SELECT COUNT(DISTINCT e.account) FROM Log e WHERE e.launchPoint IN ?1 AND e.action = 'Tile Selection' AND e.assetId IS NULL AND e.destination LIKE 'page:%' AND e.dateTime BETWEEN ?2 AND ?3"</P> Thu, 15 Mar 2018 16:53:01 GMT dwong2 2018-03-15T16:53:01Z https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355306#M5693 <P>How can this sql "like" query be translated into something the Splunk search language can understand? </P> <P>select count(*) from LOG start from X time till Y time<BR /> select uniquecount(deviceGUID) from LOG start from X time till Y time <BR /> "SELECT COUNT(DISTINCT e.account) FROM Log e WHERE e.launchPoint IN ?1 AND e.action = 'Tile Selection' AND e.assetId IS NULL AND e.destination LIKE 'page:%' AND e.dateTime BETWEEN ?2 AND ?3"</P> Thu, 15 Mar 2018 16:53:01 GMT https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355306#M5693 dwong2 2018-03-15T16:53:01Z https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355307#M5694 <P>These are a bit generic since your SQL is a bit generic but hopefully it will help you get the gist. </P> <P>select count(*) from LOG start from X time till Y time</P> <PRE><CODE>index=LOGindex sourectype=LOGsourcetype earliest=X latest=Y | stats count </CODE></PRE> <P>Fill in the index and/or sourcetype that correspond to your LOG. <BR /> Fill in the earliest and latest times that correspond to X and Y or use the time picker<BR /> stats count gets you the count(*)</P> <P>select uniquecount(deviceGUID) from LOG start from X time till Y time </P> <PRE><CODE>index=LOGindex sourectype=LOGsourcetype earliest=X latest=Y | stats dc(deviceGUID) </CODE></PRE> <P>Same as the one above only use stats dc to get a distinct count</P> <P>"SELECT COUNT(DISTINCT e.account) FROM Log e WHERE e.launchPoint IN ?1 AND e.action = 'Tile Selection' AND e.assetId IS NULL AND e.destination LIKE 'page:%' AND e.dateTime BETWEEN ?2 AND ?3"</P> <PRE><CODE>index=Logelocation sourcetype=Logesourcetype launchPoint=1 action="Title Selection" NOT assetId=* destination="*page:*" earliest="12/11/2012:20:00:00" latest="15/11/2012:20:00:00" | stats dc(e.account) </CODE></PRE> <P>index and/or sourcetype for the log as above.<BR /> Your where criteria goes in the search (before the pipe)<BR /> Using wildcards can mimic a LIKE search - destination="<EM>page:</EM>" <BR /> earliest and latest can be filled in as dates or as relative<BR /> and then your distcint count</P> Thu, 15 Mar 2018 17:26:59 GMT https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355307#M5694 kmaron 2018-03-15T17:26:59Z https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355308#M5695 <P>@kmaron Thank you for the quick response. I'll give it a try. </P> Thu, 15 Mar 2018 19:36:38 GMT https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355308#M5695 dwong2 2018-03-15T19:36:38Z https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355309#M5696 <P>Did these work out for you? If they did please accept my answer.<BR /><BR /> If not let me know so I can help. </P> Mon, 19 Mar 2018 20:11:35 GMT https://community.splunk.com/t5/Splunk-Dev/Translate-sql-to-Splunk-search-language/m-p/355309#M5696 kmaron 2018-03-19T20:11:35Z