Search Commands

This reference is generated from the search commands registered in SIEMATIC_SEARCH["COMMANDS"]. Each section documents one pipeline command.

search

Search command for querying events.

Examples: search --filter='created__gte="2025-01-01"' --select='["created","host"]' --order-by='["-created"]' --limit=100 annotate --set='avg_duration=Avg("duration")' --set='lower_host=Lower("host")' groupby --keys='["host"]' --out='total_events'

Argument	Type	Default	Description
--using	str	default	Database alias to use (default: default)
--model	str	events.Event	Django model to query, in app_label.ModelName format (default: events.Event)
--filter	str	[]	Django ORM filter expression, e.g. 'field__lookup=value'
--exclude	str	[]	Django ORM exclude expression, e.g. 'field__lookup=value'
--select	str	—	Django ORM select expression, e.g. '["field1", "field2"]'
--order-by	str	—	Django ORM order by expression, e.g. '["-field1", "field2"]'
--limit	int	—	Limit the number of results returned

groupby

GroupBy command for aggregating data. Examples: groupby --keys='["field1", "field2"]' --out='count' groupby --keys='["field1", "Sum(field2)"]' --out='sum'

Argument	Type	Default	Description
--keys	str	—	Python list/tuple literal of fields/expressions to group by, e.g. '["field1", "field2", "expr"]'
--out	str	count	Name of the output aggregated field (default: count)

annotate

Annotate command for adding calculated fields. Examples: annotate --set='avg_duration=Avg("duration")' --set='lower_host=Lower("host")'

Argument	Type	Default	Description
--set	str	[]	Set field to expression (e.g., --set='new_field=Func(arg)'), can be used multiple times. Supports placeholders ${fieldname}.

to_dataframe

ToDataFrame command for converting input data to pandas DataFrame.

This command accepts no arguments.

explode

Explode command for flattening top-level keys of a JSON field into separate columns. Examples: explode --field=data

Argument	Type	Default	Description
--field	str	—	The field containing JSON data to explode (e.g., --field=data). Top-level keys become new columns prefixed with the field name.

event_split

Split each item in an array field into a separate event.

Argument	Type	Default	Description
--field	str	—	Array field to split into separate events, e.g. --field=tags

drop

Remove one or more fields from a result set.

Examples: drop --fields='["raw", "internal_id"]'

Argument	Type	Default	Description
--fields	str	—	Fields to remove, e.g. '["field1", "field2"]'

run_saved_search

No description provided.

Argument	Type	Default	Description
name	str	—	Name of the SavedSearch to run
--events	str	—	Optional events data to pass to pipeline
--request	str	—	Optional request object

filter

Filter command for applying additional filtering conditions. Examples: filter --condition='host="server1"' filter --condition='created__gte="2025-10-01"' filter --condition='event_data__event_id=4625'

Argument	Type	Default	Description
--condition	str	—	Django ORM filter expression (e.g., 'host="server1"' or 'created__gte="2025-10-01"')

sort

Sort command for ordering data by fields. Examples: sort --fields='["created", "host"]' sort --fields='["-created"]' # descending

Argument	Type	Default	Description
--fields	str	—	Fields to sort by as a list, e.g. '["field1", "-field2"]' (use '-' prefix for descending)

head

Head command for getting the first N rows. Examples: head --n=10

Argument	Type	Default	Description
--n	int	10	Number of rows to return (default: 10)

tail

Tail command for getting the last N rows. Examples: tail --n=10

Argument	Type	Default	Description
--n	int	10	Number of rows to return (default: 10)

unique

Unique command for getting distinct values for fields. Examples: unique --fields='["host"]' unique --fields='["host", "sourcetype"]'

Argument	Type	Default	Description
--fields	str	—	Fields to get unique values for, e.g. '["field1", "field2"]'

rename

Rename command for renaming columns. Examples: rename --mapping='{"old_name": "new_name", "field2": "field_two"}'

Argument	Type	Default	Description
--mapping	str	—	Dictionary mapping old names to new names, e.g. '{"old_name": "new_name"}'

stats

Stats command for computing statistics over a result set. Examples: stats --aggregations='["count"]' stats --aggregations='["count", "avg(duration)", "max(size)"]' --by='["host"]' stats --aggregations='["sum(bytes)", "min(bytes)", "max(bytes)"]' --by='["source", "destination"]'

Argument	Type	Default	Description
--aggregations	str	—	Python list literal of aggregation expressions, e.g. '["count", "avg(field)", "sum(field)", "max(field)", "min(field)"]'
--by	str	—	Python list literal of fields to group by, e.g. '["field1", "field2"]'

join

Join command for combining data from current pipeline with another dataset. Examples: join --model='events.Event' --on='["field1", "field2"]' --how='left' --using='other_db' --filter='host="server1"'

Argument	Type	Default	Description
--model	str	events.Event	Django model to query for the join data, in app_label.ModelName format (default: events.Event)
--filter	str	[]	Django ORM filter expression for join data, e.g. 'field__lookup=value'
--exclude	str	[]	Django ORM exclude expression for join data, e.g. 'field__lookup=value'
--select	str	—	Django ORM select expression for join data, e.g. '["field1", "field2"]'
--on	str	—	List of fields to join on, e.g. '["field1", "field2"]'
--how	str	left	Type of join (default: left)
--using	str	default	Database alias for the joined data (default: default)
--limit	int	—	Limit the number of results returned