Depending on how the data is processed during a query, the format and content of the event set may change. For example, running a basic aggregation to count the number of unique hosts using the host field would change the event set from the raw event information to only the fields declared in the aggregation. For example, using the groupBy() function:

groupBy(host)

The generated event set becomes a list of unique hosts with a count of how many events were found for each host in the incoming event stream:

The function groupBy() accepts an input event set, reformats and creates a new event set containing the aggregated result:

Queries are split into individual statements separated using the pipe (|) symbol, with an event set as the input and output. This means that you can change, modify, and manipulate data within each statement and then use that as part of the input event set for the next statement.

All formatting and manipulation of the event data has to happen within the query language. For example, to change the names of the columns from out original aggregation, the rename() can be used to change the name of each column to something more human-readable:

groupBy(host)
| rename(field=[["host","Hostname"],["_count","Quantity"]])

Now the input event set to rename() is the aggregated data, and the output set is the same data but with renamed fields:

Queries may have many different statements, and each statement can filter content, extract fields, format data, summarize information, and/or any combination of these processes in different sequences. For example, filtering the information, summarizing it, and then filtering the output further.