Saved Searches (User Functions)

Searches can be saved and given a name. The Saved Search or Saved Query Once saved, this query can be used as a function as part of other queries. This can be useful where you have build a common query for search or selecting events for your given data set that you want to use in multiple queries without having to manually copy them, for example across different automations or dashboards.

To use a saved query this way you invoke it using the syntax $"SAVED_QUERY_NAME"() or, if the name does not contain whitespace or special characters you can use $nameOfSavedQuery() without quotes. A typical use for this is to define a filter or extraction ruleset that you can use as a prefix of another query.

Below is an example of how you might name and use a custom function:

logscale Syntax
$"My Saved Query"()
| $filterOutFalsePositive()
| ...

Starting from LogScale version 1.140, you can pass multi-valued arguments to a saved query. For example:

logscale
$mySavedQuery(mvArgument=["value1", "value2", "value3"])

It can be used to pass multiple values to functions, for example:

logscale
in(values=?mvArgument,field=argument)

To save a query within the UI, see Save queries.

Using Arguments with User Functions

You can add arguments to your user functions by using the ?argname in your saved query. The saved query can be called with the supplied arguments value for each named paarameter. For example, given the following query:

logscale
host = ?host

Now save the query as findhost, you can execute the query using:

logscale
$findhost(host="gendarme")

The parameter and value provided to saved queries in this way are limited to string values.

Multiple arguments can be added during the process. For example, when processing syslog data you can parse the content, create new fields, and then query that in the output:

logscale
regex(regex="Service exited due to (?<signal>\S+)")
| signal = ?signal
| regex(regex="sent by (?<process>\S+)[\d+]")
| process = ?process

Now we have two arguments which we can save to as a query killedprocess and then query for killed processes:

logscale
$killedprocess(signal="SIGKILL", process="mds")

To call with only one argument, you can set a default value for the argument using ?{argument=default}, for example:

logscale
?{signal="*" }
| ?{process="*"}
| regex(regex="Service exited due to (?<signal>\S+)")
| signal = ?signal
| regex(regex="sent by (?<process>\S+)\[\d+\]")
| process = ?process

Now you call the query with either argument:

logscale
$killedprocess(process="mds")

Starting from LogScale version 1.140, you can pass multi-valued arguments to a saved query. For example:

logscale Syntax
$mySavedQuery(mvArgument=["value1", "value2", "value3"])

It can be used to pass multiple values to functions, for example:

logscale
in(values=?mvArgument)

Using Functions as Arguments to Other Functions

Saved queries can be used in subqueries, passed to query functions that allow function arguments. However, saved queries used in such context must still meet the same requirements of the function they are in.

For example, saved queries can be used in functions such as stats() or groupBy(), like this:

logscale Syntax
groupBy("myField", function=[count(), {id=42
| $"My Saved Query"() }])