> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# bronto search

> Search events with a one-off query

Runs a query (a Bronto WHERE expression) against one or more datasets.
Without a time flag or a saved search's range it searches the last 15 minutes.
Pass '-' as the query to read it from stdin.

<Tip>
  * **Platform docs:** [docs.bronto.io/query-syntax/search-syntax](https://docs.bronto.io/query-syntax/search-syntax)
  * **API reference:** [docs.bronto.io/api-reference/search/execute-a-query](https://docs.bronto.io/api-reference/search/execute-a-query)
</Tip>

```sh theme={"dark"}
bronto search [query] [flags]
```

#### Flags

| Flag | Short | Type | Default | Description |
| - | - | - | - | - |
| `--dataset` | `-d` | stringArray | | dataset name or UUID to search (repeatable) |
| `--eq` | | field=value | | keep events where field equals value (repeatable, ANDed) |
| `--exact` | | bool | | use filter-flag field names exactly as typed, without \$-prefix or case matching |
| `--expand` | `-x` | bool | | print every field of every event, one field per line (table output only) |
| `--explain-only` | | bool | | return only the query plan and cost estimate |
| `--from` | | string | | absolute start (RFC3339) |
| `--from-expr` | | string | | dataset selector expression, e.g. "log\_id = '\<uuid>'" |
| `--ge` | | field=value | | keep events where field is greater than or equal to value |
| `--group-by` | `-g` | stringArray | | group-by key (repeatable) |
| `--gt` | | field=value | | keep events where field is greater than value |
| `--histogram` | | bool | | print a time histogram of matching events instead of the events themselves |
| `--le` | | field=value | | keep events where field is less than or equal to value |
| `--limit` | `-n` | int | `100` | maximum events to return (1-10000) |
| `--local` | | string | | run the query offline against a local NDJSON or text file ('-' for stdin) |
| `--lt` | | field=value | | keep events where field is less than value |
| `--match` | | field=value | | keep events where field matches the regex value |
| `--ne` | | field=value | | keep events where field does not equal value |
| `--nmatch` | | field=value | | keep events where field does not match the regex value |
| `--oldest-first` | | bool | | return oldest events first |
| `--open` | | bool | | open this query in the web UI instead of running it |
| `--order-by` | | string | | SQL-style order, e.g. 'duration\_ms DESC' |
| `--patterns` | | bool | | group matching events into message templates with counts (Drain-style) |
| `--saved` | | string | | run a saved search by name or id (explicit query/dataset/time flags override its stored values) |
| `--select` | | stringArray | | column or aggregate to select (repeatable) |
| `--show-query` | | bool | | print the compiled WHERE expression (the query ANDed with the filter flags) and exit |
| `--since` | | string | | relative lookback: 30s, 15m, 1h, 2d, 1w, 1h30m |
| `--slices` | | int | | timeseries buckets for aggregate queries (also sets --histogram resolution) |
| `--to` | | string | | absolute end (RFC3339), requires --from |
| `--url` | | bool | | print a web-UI link for this query instead of running it |

Also accepts the [global flags](/cli/reference/commands/global-flags).

#### Examples

```sh theme={"dark"}
bronto search "status >= 500" --since 1h
bronto search "level = 'error'" -d <dataset-uuid> --limit 50
bronto search -d <dataset> --eq model=claude-fable-5 --gt duration_ms=1000
bronto search --select "count()" -g host --since 15m
bronto search --explain-only --since 1d
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.