--dataset | -d | stringArray | | dataset name or UUID to search (repeatable) |
--eq | | field=value | | keep events where field equals value (repeatable, ANDed) |
--exact | | bool | | use filter-flag field names exactly as typed, without $-prefix or case matching |
--expand | -x | bool | | print every field of every event, one field per line (table output only) |
--explain-only | | bool | | return only the query plan and cost estimate |
--from | | string | | absolute start (RFC3339) |
--from-expr | | string | | dataset selector expression, e.g. “log_id = ‘<uuid>‘“ |
--ge | | field=value | | keep events where field is greater than or equal to value |
--group-by | -g | stringArray | | group-by key (repeatable) |
--gt | | field=value | | keep events where field is greater than value |
--histogram | | bool | | print a time histogram of matching events instead of the events themselves |
--le | | field=value | | keep events where field is less than or equal to value |
--limit | -n | int | 100 | maximum events to return (1-10000) |
--local | | string | | run the query offline against a local NDJSON or text file (’-’ for stdin) |
--lt | | field=value | | keep events where field is less than value |
--match | | field=value | | keep events where field matches the regex value |
--ne | | field=value | | keep events where field does not equal value |
--nmatch | | field=value | | keep events where field does not match the regex value |
--oldest-first | | bool | | return oldest events first |
--open | | bool | | open this query in the web UI instead of running it |
--order-by | | string | | SQL-style order, e.g. ‘duration_ms DESC’ |
--patterns | | bool | | group matching events into message templates with counts (Drain-style) |
--saved | | string | | run a saved search by name or id (explicit query/dataset/time flags override its stored values) |
--select | | stringArray | | column or aggregate to select (repeatable) |
--show-query | | bool | | print the compiled WHERE expression (the query ANDed with the filter flags) and exit |
--since | | string | | relative lookback: 30s, 15m, 1h, 2d, 1w, 1h30m |
--slices | | int | | timeseries buckets for aggregate queries (also sets —histogram resolution) |
--to | | string | | absolute end (RFC3339), requires —from |
--url | | bool | | print a web-UI link for this query instead of running it |
