Help Center/ SecMaster/ User Guide/ Log Audit/ Query and Analysis Syntax - V1/ Analysis Statements/ SELECT
Updated on 2026-05-15 GMT+08:00
View PDF
Share

SELECT

The syntax of a complete analysis statement is as follows:

1
2
3
4
 
SELECT [DISTINCT] (* | expression) [AS alias] [, ...]
[GROUP BY expression [, ...] [HAVING predicates]]
[ORDER BY expression [ASC | DESC] [, ...]]
[LIMIT size OFFSET offset]

SELECT indicates the field to be queried. The following part describes parameters and examples for the SELECT syntax.

Using * to Query All Fields

Example 1: Use * to query all fields.

1
 
*|SELECT *
Table 1 Using * to query all fields

account_number

firstname

gender

city

balance

employer

state

lastname

age

1

Amber

M

Brogan

39225

Pyrami

IL

Duke

32

16

Hattie

M

Dante

5686

Netagy

TN

Bond

36

13

Nanette

F

Nogal

32838

Quility

VA

Bates

28

18

Dale

M

Orick

4180

null

MD

Adams

32

Example 2: Use * to query all hostName = 'ecs-574a' fields.

hostName = 'ecs-574a' | SELECT *
Table 2 Query result examples

__time

hostName

hostUuid

...

2025-07-12T20:38:54.025+08:00

ecs-574a

827e17d7-4443-4d6e-9dff-7c10f29efa74

...

2025-07-12T20:38:54.025+08:00

ecs-574a

827e17d7-4443-4d6e-9dff-7c10f29efa74

...

2025-07-12T20:40:57.086+08:00

ecs-574a

827e17d7-4443-4d6e-9dff-7c10f29efa74

...

Querying Specified Fields

Use * to query all firstname and lastname fields.

1
 
*|SELECT firstname, lastname
Table 3 Querying specified fields

firstname

lastname

Amber

Duke

Hattie

Bond

Nanette

Bates

Dale

Adams

Example 2: Query logs where hostName includes HCSS-ECS-8253 and display only the hostName and ipList fields in the results.

hostName <> 'HCSS-ECS-8253' |SELECT hostName, ipList
Table 4 Example results of querying specified fields

hostName

ipList

HCSS-ECS-8253

192.168.12.58

Example 3: Query logs where hostName does not include ecs-574a and display only the hostName and ipList fields in the results.

hostName not in ('ecs-574a')|SELECT hostName, ipList
Table 5 Example results of filtering and querying specified fields

hostName

ipList

HCSS-ECS-8253

192.168.12.58

hcss_ecs_3924

192.168.4.168

hcss_ecs_3924

192.168.4.168

hcss_ecs_3924

192.168.4.168

Using AS to Define Field Aliases

1
 
*|SELECT account_number AS num
Table 6 Using AS to define field aliases

num

1

16

13

18

Using the DISTINCT Statement

1
 
*|SELECT DISTINCT age
Table 7 Using the DISTINCT statement

age

32

36

28

Using SQL Functions

For details about functions, see Functions.

1
 
*|SELECT LENGTH(firstname) as len, firstname
Table 8 Using SQL functions

len

firstname

4

Amber

6

Hattie

7

Nanette

4

Dale
Parent topic: Analysis Statements