Transforms are an important component of TQL and allow you to modify the way that your query results are returned and displayed. Transforms are separated from the rest of your query by the pipe symbol ( | ). Queries in Helix Enterprise can include multiple transforms or no transforms.
Note
Transforms can be used without filters.
This section describes the following transforms:
Unless otherwise specified, all transforms support named arguments using a key/value pair syntax. For example, the following groupby transform:
rawmsg:* | groupby srcipv4 10 1000
could also be written:
rawmsg:* | groupby field = srcipv4 limit = 10 threshold:1000
These two syntaxes are equivalent in functionality and support. Using one or the other comes down to personal preference. When using the key/value pair syntax, the order of the arguments does not matter, the colon ( : ) and equal ( = ) operators are interchangeable, and spaces around them, or lack thereof, do not matter.
Note
Transforms are supported in search only. They will not work in rules.