Help Center/ SecMaster/ User Guide/ Log Audit/ Query and Analysis Syntax - V2/ Retrieval SQL Syntax Reference/ Overview
Updated on 2026-05-15 GMT+08:00
View PDF
Share

Overview

Basic Syntax

An SQL statement consists of a query statement and an analysis statement, which are separated by a vertical bar (|). Query statements can be used independently, but analysis statements must be used together with query statements.

Query Statement | Analysis Statement
Table 1 Basic syntax

Statement Type

Description

Query Statements

A query statement is used to specify the filter criteria for log query and return the logs that meet the filter criteria. By setting filter criteria, you can quickly query required logs.

Analysis Statements

An analysis statement is used to calculate and collect statistics on query results.

Notes and Constraints

  • Query statements do not support mathematical operations, such as (age + 100) ≤ 1000.
  • Aggregate functions support only fields and do not support expressions, for example, avg(log(age)).
  • Multi-table association is not supported.
  • Subqueries are not supported.
  • A maximum of 500 records can be returned on the page.
  • A maximum of 10,000 groups can be returned by GROUP BY.

Examples

Query the log counts for hosts ecs-574a and HCSS-ECS-8253, filtered and grouped by hostName.

hostname = 'ecs-574a' or hostName = 'HCSS-ECS-8253'|select hostName,count(*) as num group by hostName
Table 2 Example for the i_sec_hss_log database

__time

hostName

hostUuid

hostIp

ipList

2025-07-12T14:38:27.764+08:00

HCSS-ECS-8253

bf9d44b0-45e2-46a3-9d23-c9965051abb6

100.64.129.14

192.168.12.58

2025-07-12T20:38:54.025+08:00

ecs-574a

827e17d7-4443-4d6e-9dff-7c10f29efa74

10.75.197.134

172.17.0.1,192.168.0.77

2025-07-12T20:38:54.025+08:00

ecs-574a

827e17d7-4443-4d6e-9dff-7c10f29efa74

10.75.197.134

172.17.0.1,192.168.0.77

2025-07-12T14:38:59.248+08:00

HCSS-ECS-8253

bf9d44b0-45e2-46a3-9d23-c9965051abb6

100.64.129.14

192.168.12.58

2025-07-12T14:39:31.747+08:00

HCSS-ECS-8253

bf9d44b0-45e2-46a3-9d23-c9965051abb6

100.64.129.14

192.168.12.58

2025-07-12T14:40:03.233+08:00

HCSS-ECS-8253

bf9d44b0-45e2-46a3-9d23-c9965051abb6

100.64.129.14

192.168.12.58

2025-07-12T14:40:35.735+08:00

HCSS-ECS-8253

bf9d44b0-45e2-46a3-9d23-c9965051abb6

100.64.129.14

192.168.12.58

2025-07-12T20:40:57.086+08:00

ecs-574a

827e17d7-4443-4d6e-9dff-7c10f29efa74

10.75.197.134

172.17.0.1,192.168.0.77
Table 3 Query result examples

hostName

num

HCSS-ECS-8253

5

ecs-574a

3