mirror of
https://github.com/tstack/lnav.git
synced 2024-09-11 13:05:51 +03:00
3124 lines
111 KiB
Plaintext
3124 lines
111 KiB
Plaintext
|
|
lnav - A fancy log file viewer
|
|
|
|
DESCRIPTION
|
|
===========
|
|
|
|
The log file navigator, lnav, is an enhanced log file viewer that
|
|
takes advantage of any semantic information that can be gleaned from
|
|
the files being viewed, such as timestamps and log levels. Using this
|
|
extra semantic information, lnav can do things like interleaving
|
|
messages from different files, generate histograms of messages over
|
|
time, and providing hotkeys for navigating through the file. It is
|
|
hoped that these features will allow the user to quickly and
|
|
efficiently zero in on problems.
|
|
|
|
|
|
OPENING PATHS/URLs
|
|
==================
|
|
|
|
The main arguments to lnav are the files, directories, glob patterns,
|
|
or URLs to be viewed. If no arguments are given, the default syslog
|
|
file for your system will be opened. These arguments will be polled
|
|
periodically so that any new data or files will be automatically
|
|
loaded. If a previously loaded file is removed or replaced, it will
|
|
be closed and the replacement opened.
|
|
|
|
Note: When opening SFTP URLs, if the password is not provided for the
|
|
host, the SSH agent can be used to do authentication.
|
|
|
|
|
|
OPTIONS
|
|
=======
|
|
|
|
Lnav takes a list of files to view and/or you can use the flag
|
|
arguments to load well-known log files, such as the syslog log
|
|
files. The flag arguments are:
|
|
|
|
-a Load all of the most recent log file types.
|
|
-r Recursively load files from the given directory hierarchies.
|
|
-R Load older rotated log files as well.
|
|
|
|
When using the flag arguments, lnav will look for the files relative
|
|
to the current directory and its parent directories. In other words,
|
|
if you are working within a directory that has the well-known log
|
|
files, those will be preferred over any others.
|
|
|
|
If you do not want the default syslog file to be loaded when
|
|
no files are specified, you can pass the '-N' flag.
|
|
|
|
Any files given on the command-line are scanned to determine their log
|
|
file format and to create an index for each line in the file. You do
|
|
not have to manually specify the log file format. The currently
|
|
supported formats are: syslog, apache, strace, tcsh history, and
|
|
generic log files with timestamps.
|
|
|
|
Lnav will also display data piped in on the standard input. The
|
|
following options are available when doing so:
|
|
|
|
-t Prepend timestamps to the lines of data being read in
|
|
on the standard input.
|
|
-w file Write the contents of the standard input to this file.
|
|
|
|
To automatically execute queries or lnav commands after the files
|
|
have been loaded, you can use the following options:
|
|
|
|
-c cmd A command, query, or file to execute. The first character
|
|
determines the type of operation: a colon is used for the
|
|
built-in commands; a semi-colon for SQL queries; and a
|
|
pipe symbol (|) for executing a file containing other
|
|
commands. For example, to open the file "foo.log" and go
|
|
to the tenth line in the file, you can do:
|
|
|
|
lnav -c ':goto 10' foo.log
|
|
|
|
This option can be given multiple times to execute multiple
|
|
operations in sequence.
|
|
|
|
-f file A file that contains commands, queries, or files to execute.
|
|
This option is a shortcut for "-c '|file'". You can use a
|
|
dash (-) to execute commands from the standard input.
|
|
|
|
To execute commands/queries without the opening the interactive text UI,
|
|
you can pass the '-n' option. This combination of options allows you to
|
|
write scripts for processing logs with lnav. For example, to get a list
|
|
of IP addresses that dhclient has bound to in CSV format:
|
|
|
|
#! /usr/bin/lnav -nf
|
|
|
|
# Usage: dhcp_ip.lnav /var/log/messages
|
|
|
|
# Only include lines that look like:
|
|
# Apr 29 00:31:56 example-centos5 dhclient: bound to 10.1.10.103 -- renewal in 9938 seconds.
|
|
:filter-in dhclient: bound to
|
|
|
|
# The log message parser will extract the IP address as col_0, so we
|
|
# select that and alias it to "dhcp_ip".
|
|
;select distinct col_0 as dhcp_ip from logline;
|
|
|
|
# Finally, write the results of the query to stdout.
|
|
:write-csv-to -
|
|
|
|
|
|
DISPLAY
|
|
=======
|
|
|
|
The main part of the display shows the log lines from the files interleaved
|
|
based on time-of-day. New lines are automatically loaded as they are appended
|
|
to the files and, if you are viewing the bottom of the files, lnav will scroll
|
|
down to display the new lines, much like 'tail -f'.
|
|
|
|
On color displays, the lines will be highlighted as follows:
|
|
|
|
* Errors will be colored in red;
|
|
* warnings will be yellow;
|
|
* boundaries between days will be underlined; and
|
|
* various color highlights will be applied to: IP addresses, SQL keywords,
|
|
XML tags, file and line numbers in Java backtraces, and quoted strings.
|
|
|
|
To give you an idea of where you are spatially, the right side of the
|
|
display has a proportionally sized 'scroll bar' that indicates your
|
|
current position in the files. The scroll bar will also show areas of
|
|
the file where warnings or errors are detected by coloring the bar
|
|
yellow or red, respectively. Tick marks will also be added to the
|
|
left and right hand side of the bar, for search hits and bookmarks.
|
|
|
|
A bar on the left side is color coded and broken up to indicate which
|
|
messages are from the same file. Pressing the left-arrow or 'h' will
|
|
reveal the source file names for each message and pressing again will
|
|
show the full paths.
|
|
|
|
When at the bottom of the log view, a summary line will be displayed on the
|
|
right-hand-side to give you some more information about your logs, including:
|
|
how long ago the last message was generated, the number of log files, the
|
|
error rate, and how much time the logs cover. The error rate display shows
|
|
the errors-per-minute over the last five minutes. A bar chart is also
|
|
overlaid on the "Error rate" label to show the error rate over the past ten
|
|
seconds. For example, if there have not been many errors in the past five
|
|
minutes and there is a sudden spike, the bar chart will fill up completely.
|
|
But, if there has been a steady stream of errors, then the chart will only
|
|
partially fill based on the recent error frequency.
|
|
|
|
Above and below the main body are status lines that display:
|
|
|
|
* the current time;
|
|
* the name of the file the top line was pulled from;
|
|
* the log format for the top line;
|
|
* the current view;
|
|
* the line number for the top line in the display;
|
|
* the current search hit, the total number of hits, and the search term;
|
|
|
|
If the view supports filtering, there will be a status line showing the
|
|
following:
|
|
|
|
* the number of enabled filters and the total number of filters;
|
|
* the number of lines not displayed because of filtering.
|
|
|
|
To edit the filters, you can press TAB to change the focus from the main
|
|
view to the filter editor. The editor allows you to create, enable/disable,
|
|
and delete filters easily.
|
|
|
|
Finally, the last line on the display is where you can enter search
|
|
patterns and execute internal commands, such as converting a
|
|
unix-timestamp into a human-readable date. The command-line is
|
|
implemented using the readline library, so the usual set of keyboard
|
|
shortcuts are available. Most commands and searches also support
|
|
tab-completion.
|
|
|
|
|
|
The body of the display is also used to display other content, such
|
|
as: the help file, histograms of the log messages over time, and
|
|
SQL results. The views are organized into a stack so that any time
|
|
you activate a new view with a key press or command, the new view
|
|
is pushed onto the stack. Pressing the same key again will pop the
|
|
view off of the stack and return you to the previous view. Note
|
|
that you can always use 'q' to pop the top view off of the stack.
|
|
|
|
|
|
KEY BINDINGS
|
|
============
|
|
|
|
Views
|
|
-----
|
|
|
|
? View/leave this help message.
|
|
q Leave the current view or quit the program when in
|
|
the log file view.
|
|
Q Similar to 'q', except it will try to sync the top time
|
|
between the current and former views. For example, when
|
|
leaving the spectrogram view with 'Q', the top time in that
|
|
view will be matched to the top time in the log view.
|
|
|
|
TAB Toggle focusing on the filter editor or the main view.
|
|
|
|
a/A Restore the view that was previously popped with 'q/Q'.
|
|
The 'A' hotkey will try to match the top times between the
|
|
two views.
|
|
|
|
X Close the current text file or log file.
|
|
|
|
Spatial Navigation
|
|
------------------
|
|
|
|
g/home Move to the top of the file.
|
|
G/end Move to the end of the file. If the view is already
|
|
at the end, it will move to the last line.
|
|
space/pgdn Move down a page.
|
|
b/bs/pgup Move up a page.
|
|
j/cr/down-arrow Move down a line.
|
|
k/up-arrow Move up a line.
|
|
h/left-arrow Move to the left. In the log view, moving left will reveal
|
|
the source log file names for each line. Pressing again
|
|
will reveal the full path.
|
|
l/right-arrow Move to the right.
|
|
H/Shift+left Move to the left by a smaller increment.
|
|
L/Shift+right Move to the right by a smaller increment.
|
|
|
|
e/E Move to the next/previous error.
|
|
w/W Move to the next/previous warning.
|
|
n/N Move to the next/previous search hit. When pressed
|
|
repeatedly within a short time, the view will move at
|
|
least a full page at a time instead of moving to the
|
|
next hit.
|
|
f/F Move to the next/previous file. In the log view, this
|
|
moves to the next line from a different file. In the
|
|
text view, this rotates the view to the next file.
|
|
|
|
>/< Move horizontally to the next/previous search hit.
|
|
|
|
o/O Move forward/backward to the log message with a matching
|
|
'operation ID' (opid) field.
|
|
|
|
u/U Move forward/backward through any user bookmarks
|
|
you have added using the 'm' key. This hotkey will
|
|
also jump to the start of any log partitions that have
|
|
been created with the 'partition-name' command.
|
|
|
|
y/Y Move forward/backward through the log view based on the
|
|
"log_line" column in the SQL result view.
|
|
|
|
s/S Move to the next/previous "slow down" in the log message
|
|
rate. A slow down is detected by measuring how quickly
|
|
the message rate has changed over the previous several
|
|
messages. For example, if one message is logged every
|
|
second for five seconds and then the last message arrives
|
|
five seconds later, the last message will be highlighted
|
|
as a slow down.
|
|
|
|
{/} Move to the previous/next location in history. Whenever
|
|
you jump to a new location in the view, the location will
|
|
be added to the history. The history is not updated when
|
|
using only the arrow keys.
|
|
|
|
|
|
Chronological Navigation
|
|
------------------------
|
|
|
|
d/D Move forward/backward 24 hours from the current
|
|
position in the log file.
|
|
|
|
1-6/Shift 1-6 Move to the next/previous n'th ten minute of the
|
|
hour. For example, '4' would move to the first
|
|
log line in the fortieth minute of the current
|
|
hour in the log. And, '6' would move to the next
|
|
hour boundary.
|
|
|
|
7/8 Move to the previous/next minute.
|
|
|
|
0/Shift 0 Move to the next/previous day boundary.
|
|
|
|
r/R Move forward/backward based on the relative time that
|
|
was last used with the 'goto' command. For example,
|
|
executing ':goto a minute later' will move the log view
|
|
forward a minute and then pressing 'r' will move it
|
|
forward a minute again. Pressing 'R' will then move the
|
|
view in the opposite direction, so backwards a minute.
|
|
|
|
Bookmarks
|
|
---------
|
|
|
|
m Mark/unmark the line at the top of the display.
|
|
The line will be highlighted with reverse video to
|
|
indicate that it is a user bookmark. You can use
|
|
the 'u' hotkey to iterate through marks you have
|
|
added.
|
|
|
|
M Mark/unmark all the lines between the top of the
|
|
display and the last line marked/unmarked.
|
|
|
|
J Mark/unmark the next line after the previously
|
|
marked line.
|
|
|
|
K Like 'J' except it toggles the mark on the
|
|
previous line.
|
|
|
|
c Copy the marked text to the X11 selection buffer or OS X
|
|
clipboard.
|
|
|
|
C Clear all marked lines.
|
|
|
|
Display options
|
|
---------------
|
|
|
|
P Switch to/from the pretty-printed view of the log or text
|
|
files currently displayed. In this view, structured data,
|
|
such as XML, will be reformatted to make it easier to read.
|
|
|
|
t Switch to/from the text file view. The text file view is
|
|
for any files that are not recognized as log files.
|
|
|
|
= Pause/unpause loading of new file data.
|
|
|
|
Ctrl-L (Lo-fi mode) Exit screen-mode and write the
|
|
displayed log lines in plain text to the terminal
|
|
until a key is pressed. Useful for copying long lines
|
|
from the terminal without picking up any of the extra
|
|
decorations.
|
|
|
|
T Toggle the display of the "elapsed time" column that shows
|
|
the time elapsed since the beginning of the logs or the
|
|
offset from the previous bookmark. Sharp changes in the
|
|
message rate are highlighted by coloring the separator
|
|
between the time column and the log message. A red
|
|
highlight means the message rate has slowed down and green
|
|
means it has sped up. You can use the "s/S" hotkeys to
|
|
scan through the slow downs.
|
|
|
|
i View/leave a histogram of the log messages over
|
|
time. The histogram counts the number of
|
|
displayed log lines for each bucket of time. The
|
|
bars are layed out horizontally with colored
|
|
segments representing the different log levels.
|
|
You can use the 'z' hotkey to change the size of
|
|
the time buckets (e.g. ten minutes, one hour, one
|
|
day).
|
|
|
|
I Switch between the log and histogram views while
|
|
keeping the time displayed at the top of each view
|
|
in sync. For example, if the top line in the log
|
|
view is "11:40", hitting 'I' will switch to the
|
|
histogram view and scrolled to display "11:00" at
|
|
the top (if the zoom level is hours).
|
|
|
|
z/Shift Z Zoom in or out one step in the histogram view.
|
|
|
|
v Switch to/from the SQL result view.
|
|
|
|
V Switch between the log and SQL result views while
|
|
keeping the top line number in the log view in
|
|
sync with the log_line column in the SQL view.
|
|
For example, doing a query that selects for
|
|
"log_idle_msecs" and "log_line", you can move the
|
|
top of the SQL view to a line and hit 'V' to switch
|
|
to the log view and move to the line number that was
|
|
selected in the "log_line" column. If there is no
|
|
"log_line" column, lnav will find the first column with
|
|
a timestamp and move to corresponding time in the log
|
|
view.
|
|
|
|
TAB/Shift+TAB In the SQL result view, cycle through the columns that
|
|
are graphed. Initially, all number values are displayed
|
|
in a stacked graph. Pressing TAB will change the display
|
|
to only graph the first column. Repeatedly pressing TAB
|
|
will cycle through the columns until they are all graphed
|
|
again.
|
|
|
|
p In the log view: enable or disable the display of the
|
|
fields that the log message parser knows about or has
|
|
discovered. This overlay is temporarily enabled when the
|
|
semicolon key (;) is pressed so that it is easier to write
|
|
queries.
|
|
|
|
In the DB view: enable or disable the display of values
|
|
in columns containing JSON-encoded values in the top row.
|
|
The overlay will display the JSON-Pointer reference and
|
|
value for all fields in the JSON data.
|
|
|
|
CTRL-W Toggle word-wrapping.
|
|
|
|
CTRL-P Show/hide the data preview panel that may be opened when
|
|
entering commands or SQL queries.
|
|
|
|
CTRL-F Toggle the enabled/disabled state of all filters in the
|
|
current view.
|
|
|
|
x Toggle the hiding of log message fields. The hidden fields
|
|
will be replaced with three bullets and highlighted in
|
|
yellow.
|
|
|
|
F2 Toggle mouse support.
|
|
|
|
Query
|
|
-----
|
|
|
|
/<regexp> Start a search for the given regular expression.
|
|
The search is live, so when there is a pause in
|
|
typing, the currently running search will be
|
|
canceled and a new one started. The first ten lines
|
|
that match the search will be displayed in the preview
|
|
window at the bottom of the view. History is
|
|
maintained for your searches so you can rerun them
|
|
easily. Words that are currently displayed are also
|
|
available for tab-completion, so you can easily
|
|
search for values without needing to copy-and-paste
|
|
the string. If there is an error encountered while
|
|
trying to interpret the expression, the error will
|
|
be displayed in red on the status line. While the
|
|
search is active, the 'hits' field in the status
|
|
line will be green, when finished it will turn
|
|
back to black.
|
|
|
|
Note: The regular expression format used by is PCRE
|
|
(Perl-Compatible Regular Expressions). For example,
|
|
if you wanted to search for ethernet device names,
|
|
regardless of their ID number, you can type:
|
|
|
|
eth\d+
|
|
|
|
You can find more information about Perl regular
|
|
expressions at:
|
|
|
|
http://perldoc.perl.org/perlre.html
|
|
|
|
If the search string is not valid PCRE, a search
|
|
is done for the exact string instead of doing a
|
|
regex search.
|
|
|
|
:<command> Execute an internal command. The commands are
|
|
listed below. History is also supported in this
|
|
context as well as tab-completion for commands and
|
|
some arguments. The result of the command
|
|
replaces the command you typed.
|
|
|
|
;<sql> Execute an SQL query. Most supported log file
|
|
formats provide a sqlite virtual table backend
|
|
that can be used in queries. See the SQL section
|
|
below for more information.
|
|
|
|
|<script> [arg1 .. argN]
|
|
Execute an lnav script contained in a format directory
|
|
(e.g. ~/.lnav/formats/default). The script can contain
|
|
lines starting with ':', ';', or '|' to execute commands,
|
|
SQL queries or execute other files in lnav. Any values
|
|
after the script name are treated as arguments can be
|
|
referenced in the script using '$1', '$2', and so on, like
|
|
in a shell script.
|
|
|
|
CTRL+], ESCAPE Abort command-line entry started with '/', ':', ';', or '|'.
|
|
|
|
Session
|
|
-------
|
|
|
|
CTRL-R Reset the session state. This will save the current
|
|
session state (filters, highlights) and then reset the
|
|
state to the factory default.
|
|
|
|
Filter Editor
|
|
-------------
|
|
|
|
The following hotkeys are only available when the focus is on the filter
|
|
editor. You can change the focus by pressing TAB.
|
|
|
|
q Switch the focus back to the main view.
|
|
j/down-arrow Select the next filter.
|
|
k/up-arrow Select the previous filter.
|
|
o Create a new "out" filter.
|
|
i Create a new "in" filter .
|
|
SPACE Toggle the enabled/disabled state of the currently
|
|
selected filter.
|
|
t Toggle the type of filter between "in" and "out".
|
|
ENTER Edit the selected filter.
|
|
D Delete the selected filter.
|
|
|
|
|
|
MOUSE SUPPORT (experimental)
|
|
============================
|
|
|
|
If you are using Xterm, or a compatible terminal, you can use the mouse to
|
|
mark lines of text and move the view by grabbing the scrollbar.
|
|
|
|
NOTE: You need to manually enable this feature by setting the LNAV_EXP
|
|
environment variable to "mouse". F2 toggles mouse support.
|
|
|
|
|
|
COMMANDS
|
|
========
|
|
|
|
help Switch to this help text view.
|
|
|
|
adjust-log-time <date|relative-time>
|
|
Change the time of the top log line to the given time or
|
|
adjusted by the relative time. All other log lines in the
|
|
same file will also be adjusted using the same offset.
|
|
After the adjustment, the displayed timestamp will be
|
|
rewritten to the new time and highlighted with a magenta
|
|
color.
|
|
|
|
This command is useful for lining up log files that
|
|
have timestamps from different machines.
|
|
|
|
unix-time <secs-or-date>
|
|
Convert a unix-timestamp in seconds to a
|
|
human-readable form or vice-versa.
|
|
BEWARE OF TIMEZONE DIFFERENCES.
|
|
|
|
current-time Print the current time in human-readable form and
|
|
as a unix-timestamp.
|
|
|
|
goto <line#|N%|abs-time|relative-time>
|
|
Go to the given line number, N percent into the
|
|
file, or the given timestamp in the log view. If the
|
|
line number is negative, it is considered an offset
|
|
from the last line. Relative time values, like
|
|
'a minute ago', 'an hour later', and many other formats
|
|
are supported. When using a relative time, the 'r/R'
|
|
hotkeys can be used to move the same amount again or in
|
|
the same amount in the opposite direction.
|
|
|
|
relative-goto <line#|N%>
|
|
Move the current view up or down by the given amount.
|
|
|
|
comment <message>
|
|
Add a comment to the top line in the log view. The
|
|
comment will be saved in the session and will be available
|
|
the next time the file is loaded. Searches will also scan
|
|
the comment for any matches.
|
|
|
|
clear-comment Clear the comment that is attached to the top line in the
|
|
log view.
|
|
|
|
tag <tag1> [<tag2> [... <tagN>]]
|
|
Attach a tag to the top line in the log view. The tags are
|
|
prefixed with a '#', if they don't have one already. And,
|
|
like comments, they are saved in the session and
|
|
searchable.
|
|
|
|
untag <tag1> [<tag2> [... <tagN>]]
|
|
Detach a tag from the top line in the log view.
|
|
|
|
delete-tags <tag1> [<tag2> [... <tagN>]]
|
|
Detach the tags from all log lines.
|
|
|
|
next-mark error|warning|search|user|file|meta
|
|
Move to the next bookmark of the given type in the
|
|
current view.
|
|
|
|
prev-mark error|warning|search|user|file|meta
|
|
Move to the previous bookmark of the given type in the
|
|
current view.
|
|
|
|
hide-lines-before <abs-time|relative-time>
|
|
Hide lines that are before the given time. The given
|
|
time can be absolute (e.g. 2015-10-11)
|
|
The hidden lines can be shown again with the
|
|
'show-lines-before-and-after' command.
|
|
|
|
hide-lines-after <abs-time|relative-time>
|
|
Hide lines that are after the given time. The time can
|
|
The hidden lines can be shown again with the
|
|
'show-lines-before-and-after' command.
|
|
|
|
show-lines-before-and-after
|
|
Show lines that were hidden by the 'hide-lines' commands.
|
|
|
|
hide-unmarked-lines
|
|
Hide lines that have not been bookmarked.
|
|
|
|
show-unmarked-lines
|
|
Show lines that have not been bookmarked.
|
|
|
|
hide-fields <field-name> [<field-name2> ... <field-nameN>]
|
|
Hide large log message fields by replacing them with an
|
|
ellipsis. You can quickly switching between showing and
|
|
hiding hidden fields using the 'x' hotkey.
|
|
|
|
show-fields <field-name> [<field-name2> ... <field-nameN>]
|
|
Show log messages fields that were previously hidden with
|
|
the ':hide-fields' command.
|
|
|
|
highlight <regex> Highlight strings that match the given regular
|
|
expression.
|
|
|
|
clear-highlight <regex>
|
|
Clear an existing highlight created with the 'highlight'
|
|
command.
|
|
|
|
filter-in <regex> Only display lines that match the given regular
|
|
expression. This command can be used multiple
|
|
times to add more lines to the display. The number
|
|
of lines that are filtered out will be shown in the
|
|
bottom status bar as 'Not Shown'. Note that filtering
|
|
only works in the log and plain text views. There is also
|
|
a limit of 32 filters per-view at any one time.
|
|
|
|
filter-out <regex>
|
|
Do not display lines that match the given regular
|
|
expression. This command can be used multiple
|
|
times to remove more lines from the display. If a
|
|
'filter-in' expression is also active, it takes
|
|
priority and the filter-out will remove lines that
|
|
were matched by the 'filter-in'. The number
|
|
of lines that are filtered out will be shown in the
|
|
bottom status bar as 'Not Shown'. Note that filtering
|
|
only works in the log and plain text views. There is also
|
|
a limit of 32 filters per-view at any one time. While
|
|
entering the regular expression at the command-prompt, the
|
|
matches in the current text view will be highlighted in red
|
|
after a short delay.
|
|
|
|
disable-filter <regex>
|
|
Disable an active 'filter-in' or 'filter-out'
|
|
expression.
|
|
|
|
enable-filter <regex>
|
|
Enable a inactive 'filter-in' or 'filter-out'
|
|
expression.
|
|
|
|
delete-filter <regex>
|
|
Permanently delete a filter.
|
|
|
|
set-min-log-level <level>
|
|
Set the minimum level to display in the log view.
|
|
You can use TAB to view the possible values.
|
|
|
|
disable-word-wrap Disable word wrapping in the log and text file views.
|
|
enable-word-wrap Enable word wrapping in the log and text file views.
|
|
|
|
open <filename>[:<line>]
|
|
Open the given file within lnav and, if it is a
|
|
text file, switch to the text view and jump to
|
|
the given line number.
|
|
|
|
close Close the current text file or log file. You can also
|
|
close the current file by pressing 'X'.
|
|
|
|
spectrogram <field-name>
|
|
Generate a spectrogram for a numeric log message field or
|
|
SQL result column. The spectrogram view displays the range
|
|
of possible values of the field on the horizontal axis and
|
|
time on the vertical axis. The horizontal axis is split
|
|
into buckets where each bucket counts how many log messages
|
|
contained the field with a value in that range. The buckets
|
|
are colored based on the count in the bucket: green means
|
|
low, yellow means medium, and red means high. The exact
|
|
ranges for the colors is computed automatically and
|
|
displayed in the middle of the top line of the view. The
|
|
minimum and maximum values for the field are displayed in
|
|
the top left and right sides of the view, respectively.
|
|
|
|
append-to <file> Append any marked lines to the given file.
|
|
|
|
write-to <file> Write any marked lines to the given file. Use '-' to
|
|
write the lines to the terminal.
|
|
|
|
write-csv-to <file>
|
|
Write the results of a SQL query to a CSV-formatted file.
|
|
When running in non-interactive mode, a dash can be used
|
|
to write to standard out. Use '-' to write the data to
|
|
the terminal.
|
|
|
|
write-json-to <file>
|
|
Write the results of a SQL query to a JSON-formatted file.
|
|
The contents of the file will be an array of objects with
|
|
each column in the query being a field in the objects.
|
|
When running in non-interactive mode, a dash can be used
|
|
to write to standard out. Use '-' to write the data to
|
|
the terminal.
|
|
|
|
write-jsonlines-to <file>
|
|
Write the results of a SQL query to a JSON-Lines-formatted
|
|
file. Each row in the result set will be a single line of
|
|
JSON in the output and each column will be a property in
|
|
that object. Use '-' to write the data to the terminal.
|
|
|
|
pipe-to <shell-cmd>
|
|
Send the currently marked lines to the given shell command
|
|
for processing and open the resulting file for viewing.
|
|
|
|
pipe-line-to <shell-cmd>
|
|
Send the top log message to the given shell command
|
|
for processing and open the resulting file for viewing.
|
|
The known and discovered message fields are available as
|
|
environment variables. For example, log_procname in a
|
|
syslog message.
|
|
|
|
redirect-to <path>
|
|
If a path is given, all output from commands, like
|
|
":echo" and when writing to stdout (e.g. :write-to -), will
|
|
be sent to the given file. If no path is specified, the
|
|
current redirect will be cleared and output will be
|
|
captured as it was before the redirect was done.
|
|
|
|
session <cmd> Add the given command to the session file
|
|
(~/.lnav/session). Any commands listed in the session file
|
|
are executed on startup. Only the highlight, word-wrap, and
|
|
filter-related commands can be added to the session file.
|
|
|
|
create-logline-table <table-name>
|
|
Create an SQL table using the top line of the log view
|
|
as a template. See the "SQL QUERIES" and "DYNAMIC LOG
|
|
LINE TABLE" sections below for more information.
|
|
|
|
delete-logline-table <table-name>
|
|
Delete an SQL table created by the 'create-logline-table'
|
|
command.
|
|
|
|
create-search-table <table-name> [<regex>]
|
|
Create an SQL table that extracts information from logs
|
|
using the provided regular expression or the last search
|
|
that was done. Any captures in the expression will be
|
|
used as columns in the SQL table. If the capture is named,
|
|
that name will be used as the column name, otherwise the
|
|
column name will be of the form 'col_N'.
|
|
|
|
delete-search-table <table-name>
|
|
Delete a table that was created with create-search-table.
|
|
|
|
switch-to-view <view-name>
|
|
Switch the display to the given view, which can be one of:
|
|
help, log, text, histogram, db, and schema.
|
|
|
|
zoom-to <zoom-level>
|
|
Change the histogram zoom level to the given value, which
|
|
can be one of: day, 4-hour, hour, 10-minute, minute
|
|
|
|
redraw Force redraw the window.
|
|
|
|
partition-name <name>
|
|
Mark the top line in the log view as the start of a new
|
|
partition with the given name. The current partition name
|
|
will be reflected in the top status bar next to the current
|
|
time as well as being available in the 'log_part' column
|
|
of the SQL log tables. Partitions can be used to make it
|
|
easier to query subsections of log messages.
|
|
|
|
clear-partition
|
|
Clear the partition the top line is a part of.
|
|
|
|
echo [-n] <msg> Display the given message. Useful for scripts to message
|
|
the user. The '-n' option leaves out the new line at the
|
|
end of the message.
|
|
|
|
eval <cmd|query|file>
|
|
Execute the given command, query, or file after doing
|
|
environment variable substitution. The argument to this
|
|
command should start with a ':', ';', or '|' signify the
|
|
type of action to perform (command, SQL query, execute
|
|
script).
|
|
|
|
pt-min-time [<date>|<relative-time>]
|
|
Set/get the minimum time range for any papertrail queries.
|
|
Absolute or relative time values can be specified.
|
|
|
|
pt-max-time [<date>|<relative-time>]
|
|
Set/get the maximum time range for any papertrail queries.
|
|
Absolute or relative time values can be specified.
|
|
|
|
config <option> [value]
|
|
Set/get the value of a configuration option.
|
|
|
|
reset-config <option>
|
|
Reset a configuration option to the default value. Use
|
|
'*' to reset all options.
|
|
|
|
quit Quit lnav.
|
|
|
|
SQL QUERIES (experimental)
|
|
===========
|
|
|
|
Lnav has support for performing SQL queries on log files using the
|
|
Sqlite3 "virtual" table feature. For all supported log file types,
|
|
lnav will create tables that can be queried using the subset of SQL
|
|
that is supported by Sqlite3. For example, to get the top ten URLs
|
|
being accessed in any loaded Apache log files, you can execute:
|
|
|
|
;select cs_uri_stem, count(*) as total from access_log
|
|
group by cs_uri_stem order by total desc limit 10;
|
|
|
|
The query result view shows the results and graphs any numeric
|
|
values found in the result, much like the histogram view.
|
|
|
|
The builtin set of log tables are listed below. Note that only the
|
|
log messages that match a particular format can be queried by a
|
|
particular table. You can find the file format and table name for
|
|
the top log message by looking in the upper right hand corner of the
|
|
log file view.
|
|
|
|
Some commonly used format tables are:
|
|
|
|
access_log Apache common access log format
|
|
syslog_log Syslog format
|
|
strace_log Strace log format
|
|
generic_log 'Generic' log format. This table contains messages
|
|
from files that have a very simple format with a
|
|
leading timestamp followed by the message.
|
|
|
|
NOTE: You can get a dump of the schema for the internal tables, and
|
|
any attached databases, by running the '.schema' SQL command.
|
|
|
|
The columns available for the top log line in the view will
|
|
automatically be displayed after pressing the semicolon (;) key.
|
|
All log tables contain at least the following columns:
|
|
|
|
log_line The line number in the file, starting at zero.
|
|
log_part The name of the partition. You can change this
|
|
column using an UPDATE SQL statement or with the
|
|
'partition-name' command. After a value is set,
|
|
the following log messages will have the same
|
|
partition name up until another name is set.
|
|
log_time The time of the log entry.
|
|
log_idle_msecs The amount of time, in milliseconds, between the
|
|
current log message and the previous one.
|
|
log_level The log level (e.g. info, error, etc...).
|
|
log_mark The bookmark status for the line. This column
|
|
can be written to using an UPDATE query.
|
|
log_path The full path to the file.
|
|
log_text The raw line of text. Note that this column is
|
|
not included in the result of a 'select *', but
|
|
it does exist.
|
|
|
|
The following tables include the basic columns as listed above and
|
|
include a few more columns since the log file format is more
|
|
structured.
|
|
|
|
syslog_log
|
|
|
|
log_hostname The hostname the message was received from.
|
|
log_procname The name of the process that sent the message.
|
|
log_pid The process ID of the process that sent the message.
|
|
|
|
access_log (The column names are the same as those in the
|
|
Microsoft LogParser tool.)
|
|
|
|
c_ip The client IP address.
|
|
cs_username The client user name.
|
|
cs_method The HTTP method.
|
|
cs_uri_stem The stem portion of the URI.
|
|
cs_uri_query The query portion of the URI.
|
|
cs_version The HTTP version string.
|
|
sc_status The status number returned to the client.
|
|
sc_bytes The number of bytes sent to the client.
|
|
cs_referrer The URL of the referring page.
|
|
cs_user_agent The user agent string.
|
|
|
|
strace_log (Currently, you need to run strace with the
|
|
"-tt -T" options so there are timestamps for
|
|
each function call.)
|
|
|
|
funcname The name of the syscall.
|
|
result The result code.
|
|
duration The amount of time spent in the syscall.
|
|
arg0 - arg9 The arguments passed to the syscall.
|
|
|
|
These tables are created dynamically and not stored in memory or on
|
|
disk. If you would like to persist some information from the tables,
|
|
you can attach another database and create tables in that database.
|
|
For example, if you wanted to save the results from the earlier
|
|
example of a top ten query into the "/tmp/topten.db" file, you can do:
|
|
|
|
;attach database "/tmp/topten.db" as topten;
|
|
;create table topten.foo as select cs_uri_stem, count(*) as total
|
|
from access_log group by cs_uri_stem order by total desc
|
|
limit 10;
|
|
|
|
|
|
DYNAMIC LOG LINE TABLE (experimental)
|
|
======================
|
|
|
|
(NOTE: This feature is still very new and not completely reliable yet,
|
|
use with care.)
|
|
|
|
For log formats that lack message structure, lnav can parse the log
|
|
message and attempt to extract any data fields that it finds. This
|
|
feature is available through the "logline" log table. This table is
|
|
dynamically created and defined based on the message at the top of
|
|
the log view. For example, given the following log message from "sudo",
|
|
lnav will create the "logline" table with columns for "TTY", "PWD",
|
|
"USER", and "COMMAND":
|
|
|
|
May 24 06:48:38 Tim-Stacks-iMac.local sudo[76387]: stack : TTY=ttys003 ;
|
|
PWD=/Users/stack/github/lbuild ; USER=root ;
|
|
COMMAND=/bin/echo Hello, World!
|
|
|
|
Queries executed against this table will then only return results for
|
|
other log messages that have the same format. So, if you were to
|
|
execute the following query while viewing the above line, you might
|
|
get the following results:
|
|
|
|
;select USER,COMMAND from logline;
|
|
|
|
USER | COMMAND
|
|
---- | -------------------------
|
|
root | /bin/echo Hello, World!
|
|
mal | /bin/echo Goodbye, World!
|
|
|
|
|
|
The log parser works by examining each message for key/value pairs
|
|
separated by an equal sign (=) or a colon (:). For example, in the
|
|
previous example of a "sudo" message, the parser sees the "USER=root"
|
|
string as a pair where the key is "USER" and the value is "root".
|
|
If no pairs can be found, then anything that looks like a value is
|
|
extracted and assigned a numbered column. For example, the following
|
|
line is from "dhcpd":
|
|
|
|
Sep 16 22:35:57 drill dhcpd: DHCPDISCOVER from 00:16:ce:54:4e:f3 via hme3
|
|
|
|
In this case, the lnav parser recognizes that "DHCPDISCOVER", the MAC
|
|
address and the "hme3" device name are values and not normal words. So,
|
|
it builds a table with three columns for each of these values. The
|
|
regular words in the message, like "from" and "via", are then used to
|
|
find other messages with a similar format.
|
|
|
|
If you would like to execute queries against log messages of different
|
|
formats at the same time, you can use the 'create-logline-table' command
|
|
to permanently create a table using the top line of the log view as a
|
|
template.
|
|
|
|
|
|
OTHER SQL FEATURES
|
|
==================
|
|
|
|
Environment variables can be used in SQL statements by prefixing the
|
|
variable name with a dollar-sign ($). For example, to read the value of
|
|
the HOME variable, you can do:
|
|
|
|
;SELECT $HOME;
|
|
|
|
To select the syslog messages that have a hostname field that is equal
|
|
to the HOSTNAME variable:
|
|
|
|
;SELECT * FROM syslog_log WHERE log_hostname = $HOSTNAME;
|
|
|
|
NOTE: Variable substitution is done for fields in the query and is not
|
|
a plain text substitution. For example, the following statement
|
|
WILL NOT WORK:
|
|
|
|
;SELECT * FROM $TABLE_NAME; -- Syntax error
|
|
|
|
|
|
Access to lnav's environment variables is also available via the "environ"
|
|
table. The table has two columns (name, value) and can be read and written
|
|
to using SQL SELECT, INSERT, UPDATE, and DELETE statements. For example,
|
|
to set the "FOO" variable to the value "BAR":
|
|
|
|
;INSERT INTO environ SELECT 'FOO', 'BAR';
|
|
|
|
As a more complex example, you can set the variable "LAST" to the last
|
|
syslog line number by doing:
|
|
|
|
;INSERT INTO environ SELECT 'LAST', (SELECT max(log_line) FROM syslog_log);
|
|
|
|
A delete will unset the environment variable:
|
|
|
|
;DELETE FROM environ WHERE name='LAST';
|
|
|
|
The table allows you to easily use the results of a SQL query in lnav
|
|
commands, which is especially useful when scripting lnav.
|
|
|
|
|
|
PAPERTRAIL INTEGRATION
|
|
======================
|
|
|
|
Papertrail is a log management service with free and paid plans at:
|
|
|
|
http://papertrailapp.com
|
|
|
|
To configure lnav to communicate with the papertrail service, you will
|
|
need to set the PAPERTRAIL_API_TOKEN environment variable. You can
|
|
get your API token from your user profile, available here:
|
|
|
|
https://papertrailapp.com/user/edit
|
|
|
|
Searching papertrail using lnav can be done by prefixing the search terms
|
|
with "pt:" and passing the value as a file name. For example, to search
|
|
for log messages with the string 'Critical Error' when starting lnav you
|
|
can do the following:
|
|
|
|
$ setenv PAPERTRAIL_API_TOKEN xxxxxxxxx
|
|
$ lnav "pt:'Critical Error'"
|
|
|
|
If lnav is already started, you can use the ':open' command like so:
|
|
|
|
:open pt:'Critical Error'
|
|
|
|
If you just want to tail your logs in papertrail, you can pass an empty
|
|
search string (i.e. "pt:").
|
|
|
|
Only one papertrail search can be active at a time. So, if an ':open'
|
|
is done with a new query, the previous query will be closed first.
|
|
|
|
|
|
CONTACT
|
|
=======
|
|
|
|
For more information, visit the lnav website at:
|
|
|
|
http://lnav.org
|
|
|
|
For support questions, email:
|
|
|
|
lnav@googlegroups.com
|
|
|
|
|
|
REFERENCE
|
|
=========
|
|
|
|
|
|
Synopsis
|
|
CAST(expr AS type-name) -- Convert the value of the given expression to a
|
|
different storage class specified by type-name.
|
|
Parameters
|
|
expr The value to convert.
|
|
type-name The name of the type to convert to.
|
|
|
|
Example
|
|
#1 To cast the value 1.23 as an integer:
|
|
;SELECT CAST(1.23 AS INTEGER)
|
|
|
|
|
|
|
|
Synopsis
|
|
OVER([base-window-name] PARTITION BY expr, ... ORDER BY expr, ...,
|
|
[frame-spec]) --
|
|
Executes the preceding function over a window
|
|
Parameters
|
|
base-window-name The name of the window definition
|
|
expr The values to use for partitioning
|
|
expr The values used to order the rows in the window
|
|
frame-spec Determines which output rows are read by an aggregate
|
|
window function
|
|
|
|
|
|
Synopsis
|
|
abs(x) -- Return the absolute value of the argument
|
|
Parameter
|
|
x The number to convert
|
|
See Also
|
|
acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(), avg(),
|
|
ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the absolute value of -1:
|
|
;SELECT abs(-1)
|
|
|
|
|
|
|
|
Synopsis
|
|
acos(num) -- Returns the arccosine of a number, in radians
|
|
Parameter
|
|
num A cosine value that is between -1 and 1
|
|
See Also
|
|
abs(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(), avg(),
|
|
ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the arccosine of 0.2:
|
|
;SELECT acos(0.2)
|
|
|
|
|
|
|
|
Synopsis
|
|
acosh(num) -- Returns the hyperbolic arccosine of a number
|
|
Parameter
|
|
num A number that is one or more
|
|
See Also
|
|
abs(), acos(), asin(), asinh(), atan(), atan2(), atanh(), atn2(), avg(), ceil(),
|
|
degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the hyperbolic arccosine of 1.2:
|
|
;SELECT acosh(1.2)
|
|
|
|
|
|
|
|
Synopsis
|
|
asin(num) -- Returns the arcsine of a number, in radians
|
|
Parameter
|
|
num A sine value that is between -1 and 1
|
|
See Also
|
|
abs(), acos(), acosh(), asinh(), atan(), atan2(), atanh(), atn2(), avg(),
|
|
ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the arcsine of 0.2:
|
|
;SELECT asin(0.2)
|
|
|
|
|
|
|
|
Synopsis
|
|
asinh(num) -- Returns the hyperbolic arcsine of a number
|
|
Parameter
|
|
num The number
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), atan(), atan2(), atanh(), atn2(), avg(), ceil(),
|
|
degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the hyperbolic arcsine of 0.2:
|
|
;SELECT asinh(0.2)
|
|
|
|
|
|
|
|
Synopsis
|
|
atan(num) -- Returns the arctangent of a number, in radians
|
|
Parameter
|
|
num The number
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan2(), atanh(), atn2(), avg(),
|
|
ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the arctangent of 0.2:
|
|
;SELECT atan(0.2)
|
|
|
|
|
|
|
|
Synopsis
|
|
atan2(y, x) -- Returns the angle in the plane between the positive X axis and
|
|
the ray from (0, 0) to the point (x, y)
|
|
Parameters
|
|
y The y coordinate of the point
|
|
x The x coordinate of the point
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atanh(), atn2(), avg(), ceil(),
|
|
degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the angle, in degrees, for the point at (5, 5):
|
|
;SELECT degrees(atan2(5, 5))
|
|
|
|
|
|
|
|
Synopsis
|
|
atanh(num) -- Returns the hyperbolic arctangent of a number
|
|
Parameter
|
|
num The number
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atn2(), avg(), ceil(),
|
|
degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the hyperbolic arctangent of 0.2:
|
|
;SELECT atanh(0.2)
|
|
|
|
|
|
|
|
Synopsis
|
|
atn2(y, x) -- Returns the angle in the plane between the positive X axis and
|
|
the ray from (0, 0) to the point (x, y)
|
|
Parameters
|
|
y The y coordinate of the point
|
|
x The x coordinate of the point
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), avg(),
|
|
ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the angle, in degrees, for the point at (5, 5):
|
|
;SELECT degrees(atn2(5, 5))
|
|
|
|
|
|
|
|
Synopsis
|
|
avg(X) -- Returns the average value of all non-NULL numbers within a group.
|
|
Parameter
|
|
X The value to compute the average of.
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Examples
|
|
#1 To get the average of the column 'ex_duration' from the table 'lnav_example_log':
|
|
;SELECT avg(ex_duration) FROM lnav_example_log
|
|
|
|
|
|
#2 To get the average of the column 'ex_duration' from the table 'lnav_example_log' when
|
|
grouped by 'ex_procname':
|
|
;SELECT ex_procname, avg(ex_duration) FROM lnav_example_log GROUP BY ex_procname
|
|
|
|
|
|
|
|
Synopsis
|
|
basename(path) -- Extract the base portion of a pathname.
|
|
Parameter
|
|
path The path
|
|
See Also
|
|
dirname(), joinpath(), readlink(), realpath()
|
|
Examples
|
|
#1 To get the base of a plain file name:
|
|
;SELECT basename('foobar')
|
|
|
|
|
|
#2 To get the base of a path:
|
|
;SELECT basename('foo/bar')
|
|
|
|
|
|
#3 To get the base of a directory:
|
|
;SELECT basename('foo/bar/')
|
|
|
|
|
|
#4 To get the base of an empty string:
|
|
;SELECT basename('')
|
|
|
|
|
|
#5 To get the base of a Windows path:
|
|
;SELECT basename('foo\bar')
|
|
|
|
|
|
#6 To get the base of the root directory:
|
|
;SELECT basename('/')
|
|
|
|
|
|
|
|
Synopsis
|
|
ceil(num) -- Returns the smallest integer that is not less than the argument
|
|
Parameter
|
|
num The number to raise to the ceiling
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the ceiling of 1.23:
|
|
;SELECT ceil(1.23)
|
|
|
|
|
|
|
|
Synopsis
|
|
changes() -- The number of database rows that were changed, inserted, or
|
|
deleted by the most recent statement.
|
|
|
|
|
|
Synopsis
|
|
char(X, ...) -- Returns a string composed of characters having the given
|
|
unicode code point values
|
|
Parameter
|
|
X The unicode code point values
|
|
See Also
|
|
charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Example
|
|
#1 To get a string with the code points 0x48 and 0x49:
|
|
;SELECT char(0x48, 0x49)
|
|
|
|
|
|
|
|
Synopsis
|
|
charindex(needle, haystack, [start]) -- Finds the first occurrence of the
|
|
needle within the haystack and returns the number of prior characters plus
|
|
1, or 0 if Y is nowhere found within X
|
|
Parameters
|
|
needle The string to look for in the haystack
|
|
haystack The string to search within
|
|
start The one-based index within the haystack to start the search
|
|
See Also
|
|
char(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Examples
|
|
#1 To search for the string 'abc' within 'abcabc' and starting at position 2:
|
|
;SELECT charindex('abc', 'abcabc', 2)
|
|
|
|
|
|
#2 To search for the string 'abc' within 'abcdef' and starting at position 2:
|
|
;SELECT charindex('abc', 'abcdef', 2)
|
|
|
|
|
|
|
|
Synopsis
|
|
coalesce(X, Y, ...) -- Returns a copy of its first non-NULL argument, or NULL
|
|
if all arguments are NULL
|
|
Parameters
|
|
X A value to check for NULL-ness
|
|
Y A value to check for NULL-ness
|
|
|
|
Example
|
|
#1 To get the first non-null value from three parameters:
|
|
;SELECT coalesce(null, 0, null)
|
|
|
|
|
|
|
|
Synopsis
|
|
count(X) -- If the argument is '*', the total number of rows in the group is
|
|
returned. Otherwise, the number of times the argument is non-NULL.
|
|
Parameter
|
|
X The value to count.
|
|
|
|
Examples
|
|
#1 To get the count of the non-NULL rows of 'lnav_example_log':
|
|
;SELECT count(*) FROM lnav_example_log
|
|
|
|
|
|
#2 To get the count of the non-NULL values of 'log_part' from 'lnav_example_log':
|
|
;SELECT count(log_part) FROM lnav_example_log
|
|
|
|
|
|
|
|
Synopsis
|
|
cume_dist() -- Returns the cumulative distribution
|
|
See Also
|
|
dense_rank(), first_value(), lag(), last_value(), lead(), nth_value(), ntile(),
|
|
percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
date(timestring, modifier, ...) -- Returns the date in this format: YYYY-MM-
|
|
DD.
|
|
Parameters
|
|
timestring The string to convert to a date.
|
|
modifier A transformation that is applied to the value to the left.
|
|
See Also
|
|
datetime(), julianday(), strftime(), time(), timediff(), timeslice()
|
|
Examples
|
|
#1 To get the date portion of the timestamp '2017-01-02T03:04:05':
|
|
;SELECT date('2017-01-02T03:04:05')
|
|
|
|
|
|
#2 To get the date portion of the timestamp '2017-01-02T03:04:05' plus one day:
|
|
;SELECT date('2017-01-02T03:04:05', '+1 day')
|
|
|
|
|
|
#3 To get the date portion of the epoch timestamp 1491341842:
|
|
;SELECT date(1491341842, 'unixepoch')
|
|
|
|
|
|
|
|
Synopsis
|
|
datetime(timestring, modifier, ...) -- Returns the date and time in this
|
|
format: YYYY-MM-DD HH:MM:SS.
|
|
Parameters
|
|
timestring The string to convert to a date with time.
|
|
modifier A transformation that is applied to the value to the left.
|
|
See Also
|
|
date(), julianday(), strftime(), time(), timediff(), timeslice()
|
|
Examples
|
|
#1 To get the date and time portion of the timestamp '2017-01-02T03:04:05':
|
|
;SELECT datetime('2017-01-02T03:04:05')
|
|
|
|
|
|
#2 To get the date and time portion of the timestamp '2017-01-02T03:04:05' plus one minute
|
|
:
|
|
;SELECT datetime('2017-01-02T03:04:05', '+1 minute')
|
|
|
|
|
|
#3 To get the date and time portion of the epoch timestamp 1491341842:
|
|
;SELECT datetime(1491341842, 'unixepoch')
|
|
|
|
|
|
|
|
Synopsis
|
|
degrees(radians) -- Converts radians to degrees
|
|
Parameter
|
|
radians The radians value to convert to degrees
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), exp(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To convert PI to degrees:
|
|
;SELECT degrees(pi())
|
|
|
|
|
|
|
|
Synopsis
|
|
dense_rank() -- Returns the row_number() of the first peer in each group
|
|
without gaps
|
|
See Also
|
|
cume_dist(), first_value(), lag(), last_value(), lead(), nth_value(), ntile(),
|
|
percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
dirname(path) -- Extract the directory portion of a pathname.
|
|
Parameter
|
|
path The path
|
|
See Also
|
|
basename(), joinpath(), readlink(), realpath()
|
|
Examples
|
|
#1 To get the directory of a relative file path:
|
|
;SELECT dirname('foo/bar')
|
|
|
|
|
|
#2 To get the directory of an absolute file path:
|
|
;SELECT dirname('/foo/bar')
|
|
|
|
|
|
#3 To get the directory of a file in the root directory:
|
|
;SELECT dirname('/bar')
|
|
|
|
|
|
#4 To get the directory of a Windows path:
|
|
;SELECT dirname('foo\bar')
|
|
|
|
|
|
#5 To get the directory of an empty path:
|
|
;SELECT dirname('')
|
|
|
|
|
|
|
|
Synopsis
|
|
endswith(str, suffix) -- Test if a string ends with the given suffix
|
|
Parameters
|
|
str The string to test
|
|
suffix The suffix to check in the string
|
|
See Also
|
|
char(), charindex(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Examples
|
|
#1 To test if the string 'notbad.jpg' ends with '.jpg':
|
|
;SELECT endswith('notbad.jpg', '.jpg')
|
|
|
|
|
|
#2 To test if the string 'notbad.png' starts with '.jpg':
|
|
;SELECT endswith('notbad.png', '.jpg')
|
|
|
|
|
|
|
|
Synopsis
|
|
exp(x) -- Returns the value of e raised to the power of x
|
|
Parameter
|
|
x The exponent
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), floor(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To raise e to 2:
|
|
;SELECT exp(2)
|
|
|
|
|
|
|
|
Synopsis
|
|
extract(str) -- Automatically Parse and extract data from a string
|
|
Parameter
|
|
str The string to parse
|
|
See Also
|
|
char(), charindex(), endswith(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Examples
|
|
#1 To extract key/value pairs from a string:
|
|
;SELECT extract('foo=1 bar=2 name="Rolo Tomassi"')
|
|
|
|
|
|
#2 To extract columnar data from a string:
|
|
;SELECT extract('1.0 abc 2.0')
|
|
|
|
|
|
|
|
Synopsis
|
|
first_value(expr) -- Returns the result of evaluating the expression against
|
|
the first row in the window frame.
|
|
Parameter
|
|
expr The expression to execute over the first row
|
|
See Also
|
|
cume_dist(), dense_rank(), lag(), last_value(), lead(), nth_value(), ntile(),
|
|
percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
floor(num) -- Returns the largest integer that is not greater than the
|
|
argument
|
|
Parameter
|
|
num The number to lower to the floor
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), log(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the floor of 1.23:
|
|
;SELECT floor(1.23)
|
|
|
|
|
|
|
|
Synopsis
|
|
generate_series(start, stop, [step]) -- A table-valued-function that returns
|
|
the whole numbers between a lower and upper bound, inclusive
|
|
Parameters
|
|
start The starting point of the series
|
|
stop The stopping point of the series
|
|
step The increment between each value
|
|
Result
|
|
value The number in the series
|
|
|
|
Examples
|
|
#1 To generate the numbers in the range [10, 14]:
|
|
;SELECT value FROM generate_series(10, 14)
|
|
|
|
|
|
#2 To generate every other number in the range [10, 14]:
|
|
;SELECT value FROM generate_series(10, 14, 2)
|
|
|
|
|
|
#3 To count down from five to 1:
|
|
;SELECT value FROM generate_series(1, 5, -1)
|
|
|
|
|
|
|
|
Synopsis
|
|
gethostbyaddr(hostname) -- Get the hostname for the given IP address
|
|
Parameter
|
|
hostname The IP address to lookup.
|
|
See Also
|
|
gethostbyname()
|
|
Example
|
|
#1 To get the hostname for the IP '127.0.0.1':
|
|
;SELECT gethostbyaddr('127.0.0.1')
|
|
|
|
|
|
|
|
Synopsis
|
|
gethostbyname(hostname) -- Get the IP address for the given hostname
|
|
Parameter
|
|
hostname The DNS hostname to lookup.
|
|
See Also
|
|
gethostbyaddr()
|
|
Example
|
|
#1 To get the IP address for 'localhost':
|
|
;SELECT gethostbyname('localhost')
|
|
|
|
|
|
|
|
Synopsis
|
|
glob(pattern, str) -- Match a string against Unix glob pattern
|
|
Parameters
|
|
pattern The glob pattern
|
|
str The string to match
|
|
|
|
Example
|
|
#1 To test if the string 'abc' matches the glob 'a*':
|
|
;SELECT glob('a*', 'abc')
|
|
|
|
|
|
|
|
Synopsis
|
|
group_concat(X, [sep]) -- Returns a string which is the concatenation of all
|
|
non-NULL values of X separated by a comma or the given separator.
|
|
Parameters
|
|
X The value to concatenate.
|
|
sep The separator to place between the values.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Examples
|
|
#1 To concatenate the values of the column 'ex_procname' from the table 'lnav_example_log'
|
|
:
|
|
;SELECT group_concat(ex_procname) FROM lnav_example_log
|
|
|
|
|
|
#2 To join the values of the column 'ex_procname' using the string ', ':
|
|
;SELECT group_concat(ex_procname, ', ') FROM lnav_example_log
|
|
|
|
|
|
#3 To concatenate the distinct values of the column 'ex_procname' from the table '
|
|
lnav_example_log':
|
|
;SELECT group_concat(DISTINCT ex_procname) FROM lnav_example_log
|
|
|
|
|
|
|
|
Synopsis
|
|
group_spooky_hash(str, ...) -- Compute the hash value for the given arguments
|
|
|
|
Parameter
|
|
str The string to hash
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Example
|
|
#1 To produce a hash of all of the values of 'column1':
|
|
;SELECT group_spooky_hash(column1) FROM (VALUES ('abc'), ('123'))
|
|
|
|
|
|
|
|
Synopsis
|
|
hex(X) -- Returns a string which is the upper-case hexadecimal rendering of
|
|
the content of its argument.
|
|
Parameter
|
|
X The blob to convert to hexadecimal
|
|
|
|
Example
|
|
#1 To get the hexadecimal rendering of the string 'abc':
|
|
;SELECT hex('abc')
|
|
|
|
|
|
|
|
Synopsis
|
|
humanize_file_size(value) -- Format the given file size as a human-friendly
|
|
string
|
|
Parameter
|
|
value The file size to format
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
instr(), leftstr(), length(), lower(), ltrim(), padc(), padl(), padr(),
|
|
printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To format an amount:
|
|
;SELECT humanize_file_size(10 * 1024 * 1024)
|
|
|
|
|
|
|
|
Synopsis
|
|
ifnull(X, Y) -- Returns a copy of its first non-NULL argument, or NULL if
|
|
both arguments are NULL
|
|
Parameters
|
|
X A value to check for NULL-ness
|
|
Y A value to check for NULL-ness
|
|
|
|
Example
|
|
#1 To get the first non-null value between null and zero:
|
|
;SELECT ifnull(null, 0)
|
|
|
|
|
|
|
|
Synopsis
|
|
instr(haystack, needle) -- Finds the first occurrence of the needle within
|
|
the haystack and returns the number of prior characters plus 1, or 0 if the
|
|
needle was not found
|
|
Parameters
|
|
haystack The string to search within
|
|
needle The string to look for in the haystack
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), leftstr(), length(), lower(), ltrim(), padc(), padl(),
|
|
padr(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To test get the position of 'b' in the string 'abc':
|
|
;SELECT instr('abc', 'b')
|
|
|
|
|
|
|
|
Synopsis
|
|
jget(json, ptr, [default]) -- Get the value from a JSON object using a JSON-
|
|
Pointer.
|
|
Parameters
|
|
json The JSON object to query.
|
|
ptr The JSON-Pointer to lookup in the object.
|
|
default The default value if the value was not found
|
|
See Also
|
|
json_concat(), json_contains(), json_group_array(), json_group_object()
|
|
Examples
|
|
#1 To get the root of a JSON value:
|
|
;SELECT jget('1', '')
|
|
|
|
|
|
#2 To get the property named 'b' in a JSON object:
|
|
;SELECT jget('{ "a": 1, "b": 2 }', '/b')
|
|
|
|
|
|
#3 To get the 'msg' property and return a default if it does not exist:
|
|
;SELECT jget(null, '/msg', 'Hello')
|
|
|
|
|
|
|
|
Synopsis
|
|
joinpath(path, ...) -- Join components of a path together.
|
|
Parameter
|
|
path One or more path components to join together. If an argument starts
|
|
with a forward or backward slash, it will be considered an absolute
|
|
path and any preceding elements will be ignored.
|
|
See Also
|
|
basename(), dirname(), readlink(), realpath()
|
|
Examples
|
|
#1 To join a directory and file name into a relative path:
|
|
;SELECT joinpath('foo', 'bar')
|
|
|
|
|
|
#2 To join an empty component with other names into a relative path:
|
|
;SELECT joinpath('', 'foo', 'bar')
|
|
|
|
|
|
#3 To create an absolute path with two path components:
|
|
;SELECT joinpath('/', 'foo', 'bar')
|
|
|
|
|
|
#4 To create an absolute path from a path component that starts with a forward slash:
|
|
;SELECT joinpath('/', 'foo', '/bar')
|
|
|
|
|
|
|
|
Synopsis
|
|
json_concat(json, value, ...) -- Returns an array with the given values
|
|
concatenated onto the end. If the initial value is null, the result will
|
|
be an array with the given elements. If the initial value is an array, the
|
|
result will be an array with the given values at the end. If the initial
|
|
value is not null or an array, the result will be an array with two
|
|
elements: the initial value and the given value.
|
|
Parameters
|
|
json The initial JSON value.
|
|
value The value(s) to add to the end of the array.
|
|
See Also
|
|
jget(), json_contains(), json_group_array(), json_group_object()
|
|
Examples
|
|
#1 To append the number 4 to null:
|
|
;SELECT json_concat(NULL, 4)
|
|
|
|
|
|
#2 To append 4 and 5 to the array [1, 2, 3]:
|
|
;SELECT json_concat('[1, 2, 3]', 4, 5)
|
|
|
|
|
|
#3 To concatenate two arrays together:
|
|
;SELECT json_concat('[1, 2, 3]', json('[4, 5]'))
|
|
|
|
|
|
|
|
Synopsis
|
|
json_contains(json, value) -- Check if a JSON value contains the given
|
|
element.
|
|
Parameters
|
|
json The JSON value to query.
|
|
value The value to look for in the first argument
|
|
See Also
|
|
jget(), json_concat(), json_group_array(), json_group_object()
|
|
Examples
|
|
#1 To test if a JSON array contains the number 4:
|
|
;SELECT json_contains('[1, 2, 3]', 4)
|
|
|
|
|
|
#2 To test if a JSON array contains the string 'def':
|
|
;SELECT json_contains('["abc", "def"]', 'def')
|
|
|
|
|
|
|
|
Synopsis
|
|
json_group_array(value, ...) -- Collect the given values from a query into a
|
|
JSON array
|
|
Parameter
|
|
value The values to append to the array
|
|
See Also
|
|
jget(), json_concat(), json_contains(), json_group_object()
|
|
Examples
|
|
#1 To create an array from arguments:
|
|
;SELECT json_group_array('one', 2, 3.4)
|
|
|
|
|
|
#2 To create an array from a column of values:
|
|
;SELECT json_group_array(column1) FROM (VALUES (1), (2), (3))
|
|
|
|
|
|
|
|
Synopsis
|
|
json_group_object(name, value, ...) -- Collect the given values from a query
|
|
into a JSON object
|
|
Parameters
|
|
name The property name for the value
|
|
value The value to add to the object
|
|
See Also
|
|
jget(), json_concat(), json_contains(), json_group_array()
|
|
Examples
|
|
#1 To create an object from arguments:
|
|
;SELECT json_group_object('a', 1, 'b', 2)
|
|
|
|
|
|
#2 To create an object from a pair of columns:
|
|
;SELECT json_group_object(column1, column2) FROM (VALUES ('a', 1), ('b', 2))
|
|
|
|
|
|
|
|
Synopsis
|
|
julianday(timestring, modifier, ...) -- Returns the number of days since noon
|
|
in Greenwich on November 24, 4714 B.C.
|
|
Parameters
|
|
timestring The string to convert to a date with time.
|
|
modifier A transformation that is applied to the value to the left.
|
|
See Also
|
|
date(), datetime(), strftime(), time(), timediff(), timeslice()
|
|
Examples
|
|
#1 To get the julian day from the timestamp '2017-01-02T03:04:05':
|
|
;SELECT julianday('2017-01-02T03:04:05')
|
|
|
|
|
|
#2 To get the julian day from the timestamp '2017-01-02T03:04:05' plus one minute:
|
|
;SELECT julianday('2017-01-02T03:04:05', '+1 minute')
|
|
|
|
|
|
#3 To get the julian day from the timestamp 1491341842:
|
|
;SELECT julianday(1491341842, 'unixepoch')
|
|
|
|
|
|
|
|
Synopsis
|
|
lag(expr, [offset], [default]) -- Returns the result of evaluating the
|
|
expression against the previous row in the partition.
|
|
Parameters
|
|
expr The expression to execute over the previous row
|
|
offset The offset from the current row in the partition
|
|
default The default value if the previous row does not exist instead of
|
|
NULL
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), last_value(), lead(), nth_value(),
|
|
ntile(), percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
last_insert_rowid() -- Returns the ROWID of the last row insert from the
|
|
database connection which invoked the function
|
|
|
|
|
|
Synopsis
|
|
last_value(expr) -- Returns the result of evaluating the expression against
|
|
the last row in the window frame.
|
|
Parameter
|
|
expr The expression to execute over the last row
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), lag(), lead(), nth_value(), ntile(),
|
|
percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
lead(expr, [offset], [default]) -- Returns the result of evaluating the
|
|
expression against the next row in the partition.
|
|
Parameters
|
|
expr The expression to execute over the next row
|
|
offset The offset from the current row in the partition
|
|
default The default value if the next row does not exist instead of NULL
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), lag(), last_value(), nth_value(),
|
|
ntile(), percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
leftstr(str, N) -- Returns the N leftmost (UTF-8) characters in the given
|
|
string.
|
|
Parameters
|
|
str The string to return subset.
|
|
N The number of characters from the left side of the string to return.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), length(), lower(), ltrim(), padc(), padl(),
|
|
padr(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To get the first character of the string 'abc':
|
|
;SELECT leftstr('abc', 1)
|
|
|
|
|
|
#2 To get the first ten characters of a string, regardless of size:
|
|
;SELECT leftstr('abc', 10)
|
|
|
|
|
|
|
|
Synopsis
|
|
length(str) -- Returns the number of characters (not bytes) in the given
|
|
string prior to the first NUL character
|
|
Parameter
|
|
str The string to determine the length of
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), lower(), ltrim(), padc(), padl(),
|
|
padr(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To get the length of the string 'abc':
|
|
;SELECT length('abc')
|
|
|
|
|
|
|
|
Synopsis
|
|
like(pattern, str, [escape]) -- Match a string against a pattern
|
|
Parameters
|
|
pattern The pattern to match. A percent symbol (%) will match zero or more
|
|
characters and an underscore (_) will match a single character.
|
|
str The string to match
|
|
escape The escape character that can be used to prefix a literal percent
|
|
or underscore in the pattern.
|
|
|
|
Examples
|
|
#1 To test if the string 'aabcc' contains the letter 'b':
|
|
;SELECT like('%b%', 'aabcc')
|
|
|
|
|
|
#2 To test if the string 'aab%' ends with 'b%':
|
|
;SELECT like('%b:%', 'aab%', ':')
|
|
|
|
|
|
|
|
Synopsis
|
|
likelihood(value, probability) -- Provides a hint to the query planner that
|
|
the first argument is a boolean that is true with the given probability
|
|
Parameters
|
|
value The boolean value to return
|
|
probability A floating point constant between 0.0 and 1.0
|
|
|
|
|
|
Synopsis
|
|
likely(value) -- Short-hand for likelihood(X,0.9375)
|
|
Parameter
|
|
value The boolean value to return
|
|
|
|
|
|
Synopsis
|
|
lnav_top_file() -- Return the name of the file that the top line in the
|
|
current view came from.
|
|
|
|
|
|
Synopsis
|
|
lnav_version() -- Return the current version of lnav
|
|
|
|
|
|
Synopsis
|
|
load_extension(path, [entry-point]) -- Loads SQLite extensions out of the
|
|
given shared library file using the given entry point.
|
|
Parameters
|
|
path The path to the shared library containing the extension.
|
|
entry-point
|
|
|
|
|
|
Synopsis
|
|
log(x) -- Returns the natural logarithm of x
|
|
Parameter
|
|
x The number
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log10(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the natual logarithm of 8:
|
|
;SELECT log(8)
|
|
|
|
|
|
|
|
Synopsis
|
|
log10(x) -- Returns the base-10 logarithm of X
|
|
Parameter
|
|
x The number
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), max(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the logarithm of 100:
|
|
;SELECT log10(100)
|
|
|
|
|
|
|
|
Synopsis
|
|
log_top_datetime() -- Return the timestamp of the line at the top of the log
|
|
view.
|
|
|
|
|
|
Synopsis
|
|
log_top_line() -- Return the line number at the top of the log view.
|
|
|
|
|
|
Synopsis
|
|
lower(str) -- Returns a copy of the given string with all ASCII characters
|
|
converted to lower case.
|
|
Parameter
|
|
str The string to convert.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), ltrim(), padc(), padl(),
|
|
padr(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To lowercase the string 'AbC':
|
|
;SELECT lower('AbC')
|
|
|
|
|
|
|
|
Synopsis
|
|
ltrim(str, [chars]) -- Returns a string formed by removing any and all
|
|
characters that appear in the second argument from the left side of the
|
|
first.
|
|
Parameters
|
|
str The string to trim characters from the left side
|
|
chars The characters to trim. Defaults to spaces.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), padc(), padl(),
|
|
padr(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To trim the leading whitespace from the string ' abc':
|
|
;SELECT ltrim(' abc')
|
|
|
|
|
|
#2 To trim the characters 'a' or 'b' from the left side of the string 'aaaabbbc':
|
|
;SELECT ltrim('aaaabbbc', 'ab')
|
|
|
|
|
|
|
|
Synopsis
|
|
max(X, ...) -- Returns the argument with the maximum value, or return NULL if
|
|
any argument is NULL.
|
|
Parameter
|
|
X The numbers to find the maximum of. If only one argument is given, this
|
|
function operates as an aggregate.
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), min(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Examples
|
|
#1 To get the largest value from the parameters:
|
|
;SELECT max(2, 1, 3)
|
|
|
|
|
|
#2 To get the largest value from an aggregate:
|
|
;SELECT max(status) FROM http_status_codes
|
|
|
|
|
|
|
|
Synopsis
|
|
min(X, ...) -- Returns the argument with the minimum value, or return NULL if
|
|
any argument is NULL.
|
|
Parameter
|
|
X The numbers to find the minimum of. If only one argument is given, this
|
|
function operates as an aggregate.
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), pi(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Examples
|
|
#1 To get the smallest value from the parameters:
|
|
;SELECT min(2, 1, 3)
|
|
|
|
|
|
#2 To get the smallest value from an aggregate:
|
|
;SELECT min(status) FROM http_status_codes
|
|
|
|
|
|
|
|
Synopsis
|
|
nth_value(expr, N) -- Returns the result of evaluating the expression against
|
|
the nth row in the window frame.
|
|
Parameters
|
|
expr The expression to execute over the nth row
|
|
N The row number
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), lag(), last_value(), lead(), ntile(),
|
|
percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
ntile(groups) -- Returns the number of the group that the current row is a
|
|
part of
|
|
Parameter
|
|
groups The number of groups
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), lag(), last_value(), lead(),
|
|
nth_value(), percent_rank(), rank(), row_number()
|
|
|
|
Synopsis
|
|
nullif(X, Y) -- Returns its first argument if the arguments are different and
|
|
NULL if the arguments are the same.
|
|
Parameters
|
|
X The first argument to compare.
|
|
Y The argument to compare against the first.
|
|
|
|
Examples
|
|
#1 To test if 1 is different from 1:
|
|
;SELECT nullif(1, 1)
|
|
|
|
|
|
#2 To test if 1 is different from 2:
|
|
;SELECT nullif(1, 2)
|
|
|
|
|
|
|
|
Synopsis
|
|
padc(str, len) -- Pad the given string with enough spaces to make it centered
|
|
within the given length
|
|
Parameters
|
|
str The string to pad
|
|
len The minimum desired length of the output string
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padl(),
|
|
padr(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To pad the string 'abc' to a length of six characters:
|
|
;SELECT padc('abc', 6) || 'def'
|
|
|
|
|
|
#2 To pad the string 'abcdef' to a length of eight characters:
|
|
;SELECT padc('abcdef', 8) || 'ghi'
|
|
|
|
|
|
|
|
Synopsis
|
|
padl(str, len) -- Pad the given string with leading spaces until it reaches
|
|
the desired length
|
|
Parameters
|
|
str The string to pad
|
|
len The minimum desired length of the output string
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padr(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To pad the string 'abc' to a length of six characters:
|
|
;SELECT padl('abc', 6)
|
|
|
|
|
|
#2 To pad the string 'abcdef' to a length of four characters:
|
|
;SELECT padl('abcdef', 4)
|
|
|
|
|
|
|
|
Synopsis
|
|
padr(str, len) -- Pad the given string with trailing spaces until it reaches
|
|
the desired length
|
|
Parameters
|
|
str The string to pad
|
|
len The minimum desired length of the output string
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), printf(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To pad the string 'abc' to a length of six characters:
|
|
;SELECT padr('abc', 6) || 'def'
|
|
|
|
|
|
#2 To pad the string 'abcdef' to a length of four characters:
|
|
;SELECT padr('abcdef', 4) || 'ghi'
|
|
|
|
|
|
|
|
Synopsis
|
|
percent_rank() -- Returns (rank - 1) / (partition-rows - 1)
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), lag(), last_value(), lead(),
|
|
nth_value(), ntile(), rank(), row_number()
|
|
|
|
Synopsis
|
|
pi() -- Returns the value of PI
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), power(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To get the value of PI:
|
|
;SELECT pi()
|
|
|
|
|
|
|
|
Synopsis
|
|
power(base, exp) -- Returns the base to the given exponent
|
|
Parameters
|
|
base The base number
|
|
exp The exponent
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(),
|
|
radians(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To raise two to the power of three:
|
|
;SELECT power(2, 3)
|
|
|
|
|
|
|
|
Synopsis
|
|
printf(format, X) -- Returns a string with this functions arguments
|
|
substituted into the given format. Substitution points are specified using
|
|
percent (%) options, much like the standard C printf() function.
|
|
Parameters
|
|
format The format of the string to return.
|
|
X The argument to substitute at a given position in the format.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), proper(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To substitute 'World' into the string 'Hello, %s!':
|
|
;SELECT printf('Hello, %s!', 'World')
|
|
|
|
|
|
#2 To right-align 'small' in the string 'align:' with a column width of 10:
|
|
;SELECT printf('align: % 10s', 'small')
|
|
|
|
|
|
#3 To format 11 with a width of five characters and leading zeroes:
|
|
;SELECT printf('value: %05d', 11)
|
|
|
|
|
|
|
|
Synopsis
|
|
proper(str) -- Capitalize the first character of words in the given string
|
|
Parameter
|
|
str The string to capitalize.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), regexp_capture(), regexp_match(), regexp_replace(),
|
|
replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To capitalize the words in the string 'hello, world!':
|
|
;SELECT proper('hello, world!')
|
|
|
|
|
|
|
|
Synopsis
|
|
quote(X) -- Returns the text of an SQL literal which is the value of its
|
|
argument suitable for inclusion into an SQL statement.
|
|
Parameter
|
|
X The string to quote.
|
|
|
|
Examples
|
|
#1 To quote the string 'abc':
|
|
;SELECT quote('abc')
|
|
|
|
|
|
#2 To quote the string 'abc'123':
|
|
;SELECT quote('abc''123')
|
|
|
|
|
|
|
|
Synopsis
|
|
radians(degrees) -- Converts degrees to radians
|
|
Parameter
|
|
degrees The degrees value to convert to radians
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(),
|
|
power(), round(), sign(), square(), sum(), total()
|
|
Example
|
|
#1 To convert 180 degrees to radians:
|
|
;SELECT radians(180)
|
|
|
|
|
|
|
|
Synopsis
|
|
raise_error(msg) -- Raises an error with the given message when executed
|
|
Parameter
|
|
msg The error message
|
|
|
|
|
|
Synopsis
|
|
random() -- Returns a pseudo-random integer between -9223372036854775808 and
|
|
+9223372036854775807.
|
|
|
|
|
|
Synopsis
|
|
randomblob(N) -- Return an N-byte blob containing pseudo-random bytes.
|
|
Parameter
|
|
N The size of the blob in bytes.
|
|
|
|
|
|
Synopsis
|
|
rank() -- Returns the row_number() of the first peer in each group with gaps
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), lag(), last_value(), lead(),
|
|
nth_value(), ntile(), percent_rank(), row_number()
|
|
|
|
Synopsis
|
|
readlink(path) -- Read the target of a symbolic link.
|
|
Parameter
|
|
path The path to the symbolic link.
|
|
See Also
|
|
basename(), dirname(), joinpath(), realpath()
|
|
|
|
Synopsis
|
|
realpath(path) -- Returns the resolved version of the given path, expanding
|
|
symbolic links and resolving '.' and '..' references.
|
|
Parameter
|
|
path The path to resolve.
|
|
See Also
|
|
basename(), dirname(), joinpath(), readlink()
|
|
|
|
Synopsis
|
|
regexp(re, str) -- Test if a string matches a regular expression
|
|
Parameters
|
|
re The regular expression to use
|
|
str The string to test against the regular expression
|
|
|
|
|
|
Synopsis
|
|
regexp_capture(string, pattern) -- A table-valued function that executes a
|
|
regular-expression over a string and returns the captured values. If the
|
|
regex only matches a subset of the input string, it will be rerun on the
|
|
remaining parts of the string until no more matches are found.
|
|
Parameters
|
|
string The string to match against the given pattern.
|
|
pattern The regular expression to match.
|
|
Results
|
|
match_index The match iteration. This value will increase each time a
|
|
new match is found in the input string.
|
|
capture_index The index of the capture in the regex.
|
|
capture_name The name of the capture in the regex.
|
|
capture_count The total number of captures in the regex.
|
|
range_start The start of the capture in the input string.
|
|
range_stop The stop of the capture in the input string.
|
|
content The captured value from the string.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_match(), regexp_replace(), replace(),
|
|
replicate(), reverse(), rightstr(), rtrim(), sparkline(), spooky_hash(),
|
|
startswith(), strfilter(), substr(), trim(), unicode(), upper(), xpath()
|
|
Example
|
|
#1 To extract the key/value pairs 'a'/1 and 'b'/2 from the string 'a=1; b=2':
|
|
;SELECT * FROM regexp_capture('a=1; b=2', '(\w+)=(\d+)')
|
|
|
|
|
|
|
|
Synopsis
|
|
regexp_match(re, str) -- Match a string against a regular expression and
|
|
return the capture groups as JSON.
|
|
Parameters
|
|
re The regular expression to use
|
|
str The string to test against the regular expression
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_replace(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Examples
|
|
#1 To capture the digits from the string '123':
|
|
;SELECT regexp_match('(\d+)', '123')
|
|
|
|
|
|
#2 To capture a number and word into a JSON object with the properties 'col_0' and 'col_1'
|
|
:
|
|
;SELECT regexp_match('(\d+) (\w+)', '123 four')
|
|
|
|
|
|
#3 To capture a number and word into a JSON object with the named properties 'num' and '
|
|
str':
|
|
;SELECT regexp_match('(?<num>\d+) (?<str>\w+)', '123 four')
|
|
|
|
|
|
|
|
Synopsis
|
|
regexp_replace(str, re, repl) -- Replace the parts of a string that match a
|
|
regular expression.
|
|
Parameters
|
|
str The string to perform replacements on
|
|
re The regular expression to match
|
|
repl The replacement string. You can reference capture groups with a
|
|
backslash followed by the number of the group, starting with 1.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_match(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper(), xpath()
|
|
Examples
|
|
#1 To replace the word at the start of the string 'Hello, World!' with 'Goodbye':
|
|
;SELECT regexp_replace('Hello, World!', '^(\w+)', 'Goodbye')
|
|
|
|
|
|
#2 To wrap alphanumeric words with angle brackets:
|
|
;SELECT regexp_replace('123 abc', '(\w+)', '<\1>')
|
|
|
|
|
|
|
|
Synopsis
|
|
replace(str, old, replacement) -- Returns a string formed by substituting the
|
|
replacement string for every occurrence of the old string in the given
|
|
string.
|
|
Parameters
|
|
str The string to perform substitutions on.
|
|
old The string to be replaced.
|
|
replacement The string to replace any occurrences of the old string with.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replicate(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To replace the string 'x' with 'z' in 'abc':
|
|
;SELECT replace('abc', 'x', 'z')
|
|
|
|
|
|
#2 To replace the string 'a' with 'z' in 'abc':
|
|
;SELECT replace('abc', 'a', 'z')
|
|
|
|
|
|
|
|
Synopsis
|
|
replicate(str, N) -- Returns the given string concatenated N times.
|
|
Parameters
|
|
str The string to replicate.
|
|
N The number of times to replicate the string.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), reverse(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To repeat the string 'abc' three times:
|
|
;SELECT replicate('abc', 3)
|
|
|
|
|
|
|
|
Synopsis
|
|
reverse(str) -- Returns the reverse of the given string.
|
|
Parameter
|
|
str The string to reverse.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), rightstr(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To reverse the string 'abc':
|
|
;SELECT reverse('abc')
|
|
|
|
|
|
|
|
Synopsis
|
|
rightstr(str, N) -- Returns the N rightmost (UTF-8) characters in the given
|
|
string.
|
|
Parameters
|
|
str The string to return subset.
|
|
N The number of characters from the right side of the string to return.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rtrim(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To get the last character of the string 'abc':
|
|
;SELECT rightstr('abc', 1)
|
|
|
|
|
|
#2 To get the last ten characters of a string, regardless of size:
|
|
;SELECT rightstr('abc', 10)
|
|
|
|
|
|
|
|
Synopsis
|
|
round(num, [digits]) -- Returns a floating-point value rounded to the given
|
|
number of digits to the right of the decimal point.
|
|
Parameters
|
|
num The value to round.
|
|
digits The number of digits to the right of the decimal to round to.
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(),
|
|
power(), radians(), sign(), square(), sum(), total()
|
|
Examples
|
|
#1 To round the number 123.456 to an integer:
|
|
;SELECT round(123.456)
|
|
|
|
|
|
#2 To round the number 123.456 to a precision of 1:
|
|
;SELECT round(123.456, 1)
|
|
|
|
|
|
#3 To round the number 123.456 to a precision of 5:
|
|
;SELECT round(123.456, 5)
|
|
|
|
|
|
|
|
Synopsis
|
|
row_number() -- Returns the number of the row within the current partition,
|
|
starting from 1.
|
|
See Also
|
|
cume_dist(), dense_rank(), first_value(), lag(), last_value(), lead(),
|
|
nth_value(), ntile(), percent_rank(), rank()
|
|
Example
|
|
#1 To number messages from a process:
|
|
;SELECT row_number() OVER (PARTITION BY ex_procname ORDER BY log_line) AS msg_num,
|
|
ex_procname, log_body FROM lnav_example_log
|
|
|
|
|
|
|
|
Synopsis
|
|
rtrim(str, [chars]) -- Returns a string formed by removing any and all
|
|
characters that appear in the second argument from the right side of the
|
|
first.
|
|
Parameters
|
|
str The string to trim characters from the right side
|
|
chars The characters to trim. Defaults to spaces.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), sparkline(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To trim the whitespace from the end of the string 'abc ':
|
|
;SELECT rtrim('abc ')
|
|
|
|
|
|
#2 To trim the characters 'b' and 'c' from the string 'abbbbcccc':
|
|
;SELECT rtrim('abbbbcccc', 'bc')
|
|
|
|
|
|
|
|
Synopsis
|
|
sign(num) -- Returns the sign of the given number as -1, 0, or 1
|
|
Parameter
|
|
num The number
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(),
|
|
power(), radians(), round(), square(), sum(), total()
|
|
Examples
|
|
#1 To get the sign of 10:
|
|
;SELECT sign(10)
|
|
|
|
|
|
#2 To get the sign of 0:
|
|
;SELECT sign(0)
|
|
|
|
|
|
#3 To get the sign of -10:
|
|
;SELECT sign(-10)
|
|
|
|
|
|
|
|
Synopsis
|
|
sparkline(value, [upper]) -- Function used to generate a sparkline bar chart.
|
|
The non-aggregate version converts a single numeric value on a range to a
|
|
bar chart character. The aggregate version returns a string with a bar
|
|
character for every numeric input
|
|
Parameters
|
|
value The numeric value to convert
|
|
upper The upper bound of the numeric range. The non-aggregate version
|
|
defaults to 100. The aggregate version uses the largest value in the
|
|
inputs.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
spooky_hash(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To get the unicode block element for the value 32 in the range of 0-128:
|
|
;SELECT sparkline(32, 128)
|
|
|
|
|
|
#2 To chart the values in a JSON array:
|
|
;SELECT sparkline(value) FROM json_each('[0, 1, 2, 3, 4, 5, 6, 7, 8]')
|
|
|
|
|
|
|
|
Synopsis
|
|
spooky_hash(str, ...) -- Compute the hash value for the given arguments.
|
|
Parameter
|
|
str The string to hash
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), startswith(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To produce a hash for the string 'Hello, World!':
|
|
;SELECT spooky_hash('Hello, World!')
|
|
|
|
|
|
#2 To produce a hash for the parameters where one is NULL:
|
|
;SELECT spooky_hash('Hello, World!', NULL)
|
|
|
|
|
|
#3 To produce a hash for the parameters where one is an empty string:
|
|
;SELECT spooky_hash('Hello, World!', '')
|
|
|
|
|
|
#4 To produce a hash for the parameters where one is a number:
|
|
;SELECT spooky_hash('Hello, World!', 123)
|
|
|
|
|
|
|
|
Synopsis
|
|
sqlite_compileoption_get(N) -- Returns the N-th compile-time option used to
|
|
build SQLite or NULL if N is out of range.
|
|
Parameter
|
|
N The option number to get
|
|
|
|
|
|
Synopsis
|
|
sqlite_compileoption_used(option) -- Returns true (1) or false (0) depending
|
|
on whether or not that compile-time option was used during the build.
|
|
Parameter
|
|
option The name of the compile-time option.
|
|
|
|
Example
|
|
#1 To check if the SQLite library was compiled with ENABLE_FTS3:
|
|
;SELECT sqlite_compileoption_used('ENABLE_FTS3')
|
|
|
|
|
|
|
|
Synopsis
|
|
sqlite_source_id() -- Returns a string that identifies the specific version
|
|
of the source code that was used to build the SQLite library.
|
|
|
|
|
|
Synopsis
|
|
sqlite_version() -- Returns the version string for the SQLite library that is
|
|
running.
|
|
|
|
|
|
Synopsis
|
|
square(num) -- Returns the square of the argument
|
|
Parameter
|
|
num The number to square
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(),
|
|
power(), radians(), round(), sign(), sum(), total()
|
|
Example
|
|
#1 To get the square of two:
|
|
;SELECT square(2)
|
|
|
|
|
|
|
|
Synopsis
|
|
startswith(str, prefix) -- Test if a string begins with the given prefix
|
|
Parameters
|
|
str The string to test
|
|
prefix The prefix to check in the string
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), strfilter(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Examples
|
|
#1 To test if the string 'foobar' starts with 'foo':
|
|
;SELECT startswith('foobar', 'foo')
|
|
|
|
|
|
#2 To test if the string 'foobar' starts with 'bar':
|
|
;SELECT startswith('foobar', 'bar')
|
|
|
|
|
|
|
|
Synopsis
|
|
strfilter(source, include) -- Returns the source string with only the
|
|
characters given in the second parameter
|
|
Parameters
|
|
source The string to filter
|
|
include The characters to include in the result
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), substr(), trim(), unicode(), upper(),
|
|
xpath()
|
|
Example
|
|
#1 To get the 'b', 'c', and 'd' characters from the string 'abcabc':
|
|
;SELECT strfilter('abcabc', 'bcd')
|
|
|
|
|
|
|
|
Synopsis
|
|
strftime(format, timestring, modifier, ...) -- Returns the date formatted
|
|
according to the format string specified as the first argument.
|
|
Parameters
|
|
format A format string with substitutions similar to those found in the
|
|
strftime() standard C library.
|
|
timestring The string to convert to a date with time.
|
|
modifier A transformation that is applied to the value to the left.
|
|
See Also
|
|
date(), datetime(), julianday(), time(), timediff(), timeslice()
|
|
Examples
|
|
#1 To get the year from the timestamp '2017-01-02T03:04:05':
|
|
;SELECT strftime('%Y', '2017-01-02T03:04:05')
|
|
|
|
|
|
#2 To create a string with the time from the timestamp '2017-01-02T03:04:05' plus one
|
|
minute:
|
|
;SELECT strftime('The time is: %H:%M:%S', '2017-01-02T03:04:05', '+1 minute')
|
|
|
|
|
|
#3 To create a string with the Julian day from the epoch timestamp 1491341842:
|
|
;SELECT strftime('Julian day: %J', 1491341842, 'unixepoch')
|
|
|
|
|
|
|
|
Synopsis
|
|
substr(str, start, [size]) -- Returns a substring of input string X that
|
|
begins with the Y-th character and which is Z characters long.
|
|
Parameters
|
|
str The string to extract a substring from.
|
|
start The index within 'str' that is the start of the substring. Indexes
|
|
begin at 1. A negative value means that the substring is found by
|
|
counting from the right rather than the left.
|
|
size The size of the substring. If not given, then all characters through
|
|
the end of the string are returned. If the value is negative, then
|
|
the characters before the start are returned.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), trim(), unicode(),
|
|
upper(), xpath()
|
|
Examples
|
|
#1 To get the substring starting at the second character until the end of the string 'abc'
|
|
:
|
|
;SELECT substr('abc', 2)
|
|
|
|
|
|
#2 To get the substring of size one starting at the second character of the string 'abc':
|
|
;SELECT substr('abc', 2, 1)
|
|
|
|
|
|
#3 To get the substring starting at the last character until the end of the string 'abc':
|
|
;SELECT substr('abc', -1)
|
|
|
|
|
|
#4 To get the substring starting at the last character and going backwards one step of the
|
|
string 'abc':
|
|
;SELECT substr('abc', -1, -1)
|
|
|
|
|
|
|
|
Synopsis
|
|
sum(X) -- Returns the sum of the values in the group as an integer.
|
|
Parameter
|
|
X The values to add.
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(),
|
|
power(), radians(), round(), sign(), square(), total()
|
|
Example
|
|
#1 To sum all of the values in the column 'ex_duration' from the table 'lnav_example_log':
|
|
;SELECT sum(ex_duration) FROM lnav_example_log
|
|
|
|
|
|
|
|
Synopsis
|
|
time(timestring, modifier, ...) -- Returns the time in this format: HH:MM:SS.
|
|
|
|
Parameters
|
|
timestring The string to convert to a time.
|
|
modifier A transformation that is applied to the value to the left.
|
|
See Also
|
|
date(), datetime(), julianday(), strftime(), timediff(), timeslice()
|
|
Examples
|
|
#1 To get the time portion of the timestamp '2017-01-02T03:04:05':
|
|
;SELECT time('2017-01-02T03:04:05')
|
|
|
|
|
|
#2 To get the time portion of the timestamp '2017-01-02T03:04:05' plus one minute:
|
|
;SELECT time('2017-01-02T03:04:05', '+1 minute')
|
|
|
|
|
|
#3 To get the time portion of the epoch timestamp 1491341842:
|
|
;SELECT time(1491341842, 'unixepoch')
|
|
|
|
|
|
|
|
Synopsis
|
|
timediff(time1, time2) -- Compute the difference between two timestamps in
|
|
seconds
|
|
Parameters
|
|
time1 The first timestamp
|
|
time2 The timestamp to subtract from the first
|
|
See Also
|
|
date(), datetime(), julianday(), strftime(), time(), timeslice()
|
|
Examples
|
|
#1 To get the difference between two timestamps:
|
|
;SELECT timediff('2017-02-03T04:05:06', '2017-02-03T04:05:00')
|
|
|
|
|
|
#2 To get the difference between relative timestamps:
|
|
;SELECT timediff('today', 'yesterday')
|
|
|
|
|
|
|
|
Synopsis
|
|
timeslice(time, slice) -- Return the start of the slice of time that the
|
|
given timestamp falls in. If the time falls outside of the slice, NULL is
|
|
returned.
|
|
Parameters
|
|
time The timestamp to get the time slice for.
|
|
slice The size of the time slices
|
|
See Also
|
|
date(), datetime(), julianday(), strftime(), time(), timediff()
|
|
Examples
|
|
#1 To get the timestamp rounded down to the start of the ten minute slice:
|
|
;SELECT timeslice('2017-01-01T05:05:00', '10m')
|
|
|
|
|
|
#2 To group log messages into five minute buckets and count them:
|
|
;SELECT timeslice(log_time_msecs, '5m') AS slice, count(1) FROM lnav_example_log GROUP
|
|
BY slice
|
|
|
|
|
|
#3 To group log messages by those before 4:30am and after:
|
|
;SELECT timeslice(log_time_msecs, 'before 4:30am') AS slice, count(1) FROM
|
|
lnav_example_log GROUP BY slice
|
|
|
|
|
|
|
|
Synopsis
|
|
total(X) -- Returns the sum of the values in the group as a floating-point.
|
|
Parameter
|
|
X The values to add.
|
|
See Also
|
|
abs(), acos(), acosh(), asin(), asinh(), atan(), atan2(), atanh(), atn2(),
|
|
avg(), ceil(), degrees(), exp(), floor(), log(), log10(), max(), min(), pi(),
|
|
power(), radians(), round(), sign(), square(), sum()
|
|
Example
|
|
#1 To total all of the values in the column 'ex_duration' from the table 'lnav_example_log
|
|
':
|
|
;SELECT total(ex_duration) FROM lnav_example_log
|
|
|
|
|
|
|
|
Synopsis
|
|
total_changes() -- Returns the number of row changes caused by INSERT, UPDATE
|
|
or DELETE statements since the current database connection was opened.
|
|
|
|
|
|
Synopsis
|
|
trim(str, [chars]) -- Returns a string formed by removing any and all
|
|
characters that appear in the second argument from the left and right sides
|
|
of the first.
|
|
Parameters
|
|
str The string to trim characters from the left and right sides.
|
|
chars The characters to trim. Defaults to spaces.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), unicode(),
|
|
upper(), xpath()
|
|
Examples
|
|
#1 To trim whitespace from the start and end of the string ' abc ':
|
|
;SELECT trim(' abc ')
|
|
|
|
|
|
#2 To trim the characters '-' and '+' from the string '-+abc+-':
|
|
;SELECT trim('-+abc+-', '-+')
|
|
|
|
|
|
|
|
Synopsis
|
|
typeof(X) -- Returns a string that indicates the datatype of the expression X
|
|
: "null", "integer", "real", "text", or "blob".
|
|
Parameter
|
|
X The expression to check.
|
|
|
|
Examples
|
|
#1 To get the type of the number 1:
|
|
;SELECT typeof(1)
|
|
|
|
|
|
#2 To get the type of the string 'abc':
|
|
;SELECT typeof('abc')
|
|
|
|
|
|
|
|
Synopsis
|
|
unicode(X) -- Returns the numeric unicode code point corresponding to the
|
|
first character of the string X.
|
|
Parameter
|
|
X The string to examine.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
upper(), xpath()
|
|
Example
|
|
#1 To get the unicode code point for the first character of 'abc':
|
|
;SELECT unicode('abc')
|
|
|
|
|
|
|
|
Synopsis
|
|
unlikely(value) -- Short-hand for likelihood(X, 0.0625)
|
|
Parameter
|
|
value The boolean value to return
|
|
|
|
|
|
Synopsis
|
|
upper(str) -- Returns a copy of the given string with all ASCII characters
|
|
converted to upper case.
|
|
Parameter
|
|
str The string to convert.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), xpath()
|
|
Example
|
|
#1 To uppercase the string 'aBc':
|
|
;SELECT upper('aBc')
|
|
|
|
|
|
|
|
Synopsis
|
|
xpath(xpath, xmldoc) -- A table-valued function that executes an xpath
|
|
expression over an XML string and returns the selected values.
|
|
Parameters
|
|
xpath The XPATH expression to evaluate over the XML document.
|
|
xmldoc The XML document as a string.
|
|
Results
|
|
result The result of the XPATH expression.
|
|
node_path The absolute path to the node containing the result.
|
|
node_attr The node's attributes stored in JSON object.
|
|
node_text The node's text value.
|
|
See Also
|
|
char(), charindex(), endswith(), extract(), group_concat(), group_spooky_hash(),
|
|
humanize_file_size(), instr(), leftstr(), length(), lower(), ltrim(), padc(),
|
|
padl(), padr(), printf(), proper(), regexp_capture(), regexp_match(),
|
|
regexp_replace(), replace(), replicate(), reverse(), rightstr(), rtrim(),
|
|
sparkline(), spooky_hash(), startswith(), strfilter(), substr(), trim(),
|
|
unicode(), upper()
|
|
Examples
|
|
#1 To select the XML nodes on the path '/abc/def':
|
|
;SELECT * FROM xpath('/abc/def', '<abc><def a="b">Hello</def><def>Bye</def></abc>')
|
|
|
|
|
|
#2 To select all 'a' attributes on the path '/abc/def':
|
|
;SELECT * FROM xpath('/abc/def/@a', '<abc><def a="b">Hello</def><def>Bye</def></abc>')
|
|
|
|
|
|
#3 To select the text nodes on the path '/abc/def':
|
|
;SELECT * FROM xpath('/abc/def/text()', '<abc><def a="b">Hello ★</def></abc>')
|
|
|
|
|
|
|
|
Synopsis
|
|
zeroblob(N) -- Returns a BLOB consisting of N bytes of 0x00.
|
|
Parameter
|
|
N The size of the BLOB.
|
|
|
|
|
|
Synopsis
|
|
ATTACH DATABASE filename AS schema-name
|
|
|
|
Attach a database file to the current connection.
|
|
Parameters
|
|
filename The path to the database file.
|
|
schema-name The prefix for tables in this database.
|
|
|
|
Example
|
|
#1 To attach the database file '/tmp/customers.db' with the name customers:
|
|
;ATTACH DATABASE '/tmp/customers.db' AS customers
|
|
|
|
|
|
|
|
Synopsis
|
|
CASE [base-expr] WHEN cmp-expr1 THEN then-expr1 [... WHEN cmp-exprN THEN then-exprN]
|
|
[ELSE else-expr]
|
|
END
|
|
|
|
Evaluate a series of expressions in order until one evaluates to true and
|
|
then return it's result. Similar to an IF-THEN-ELSE construct in other
|
|
languages.
|
|
Parameters
|
|
base-expr The base expression that is used for comparison in the branches
|
|
cmp-expr The expression to test if this branch should be taken
|
|
else-expr The result of this CASE if no branches matched.
|
|
|
|
Example
|
|
#1 To evaluate the number one and return the string 'one':
|
|
;SELECT CASE 1 WHEN 0 THEN 'zero' WHEN 1 THEN 'one' END
|
|
|
|
|
|
|
|
Synopsis
|
|
CREATE [TEMP] VIEW [IF NOT EXISTS] [schema-name.] view-name AS select-stmt
|
|
|
|
Assign a name to a SELECT statement
|
|
Parameters
|
|
IF NOT EXISTS Do not create the view if it already exists
|
|
schema-name. The database to create the view in
|
|
view-name The name of the view
|
|
select-stmt The SELECT statement the view represents
|
|
|
|
|
|
Synopsis
|
|
DELETE FROM table-name [WHERE cond]
|
|
|
|
Delete rows from a table
|
|
Parameters
|
|
table-name The name of the table
|
|
cond The conditions used to delete the rows.
|
|
|
|
|
|
Synopsis
|
|
DETACH DATABASE schema-name
|
|
|
|
Detach a database from the current connection.
|
|
Parameter
|
|
schema-name The prefix for tables in this database.
|
|
|
|
Example
|
|
#1 To detach the database named 'customers':
|
|
;DETACH DATABASE customers
|
|
|
|
|
|
|
|
Synopsis
|
|
DROP VIEW [IF EXISTS] [schema-name.] view-name
|
|
|
|
Drop a view
|
|
Parameters
|
|
|
|
|
|
Synopsis
|
|
INSERT INTO [schema-name.] table-name [( column-name1 [, ... column-nameN] )]
|
|
VALUES ( expr1 [, ... exprN] )
|
|
|
|
Insert rows into a table
|
|
Parameters
|
|
|
|
Example
|
|
#1 To insert the pair containing 'MSG' and 'HELLO, WORLD!' into the 'environ'
|
|
table:
|
|
;INSERT INTO environ VALUES ('MSG', 'HELLO, WORLD!')
|
|
|
|
|
|
|
|
Synopsis
|
|
OVER window-name
|
|
|
|
Executes the preceding function over a window
|
|
Parameter
|
|
window-name The name of the window definition
|
|
|
|
|
|
Synopsis
|
|
SELECT result-column1 [, ... result-columnN] [FROM table1 [, ... tableN]]
|
|
[WHERE cond]
|
|
[GROUP BY grouping-expr1 [, ... grouping-exprN]]
|
|
[ORDER BY ordering-term1 [, ... ordering-termN]]
|
|
[LIMIT limit-expr1 [, ... limit-exprN]]
|
|
|
|
Query the database and return zero or more rows of data.
|
|
Parameters
|
|
result-column
|
|
table The table(s) to query for data
|
|
cond The conditions used to select the rows to return.
|
|
grouping-expr The expression to use when grouping rows.
|
|
ordering-term The values to use when ordering the result set.
|
|
limit-expr The maximum number of rows to return
|
|
|
|
Example
|
|
#1 To select all of the columns from the table 'syslog_log':
|
|
;SELECT * FROM syslog_log
|
|
|
|
|
|
|
|
Synopsis
|
|
UPDATE table SET column-name1 = expr1 [, ... column-nameN = exprN]
|
|
[WHERE cond]
|
|
|
|
Modify a subset of values in zero or more rows of the given table
|
|
Parameters
|
|
table The table to update
|
|
column-name The columns in the table to update.
|
|
cond The condition used to determine whether a row should be
|
|
updated.
|
|
|
|
Example
|
|
#1 To mark the syslog message at line 40:
|
|
;UPDATE syslog_log SET log_mark = 1 WHERE log_line = 40
|
|
|
|
|
|
|
|
Synopsis
|
|
WITH [RECURSIVE] cte-table-name AS select-stmt
|
|
|
|
Create a temporary view that exists only for the duration of a SQL statement.
|
|
|
|
Parameters
|
|
cte-table-name The name for the temporary table.
|
|
select-stmt The SELECT statement used to populate the temporary table.
|
|
|