Search Commands

This reference is generated from the search commands registered in SIEMATIC_SEARCH["COMMANDS"]. Each section documents one pipeline command.

Search command for querying events.

Examples: search --filter='created__gte="2025-01-01"' --select='["created","host"]' --order-by='["-created"]' --limit=100 annotate --set='avg_duration=Avg("duration")' --set='lower_host=Lower("host")' groupby --keys='["host"]' --out='total_events'

Argument Type Default Description
--using str default Database alias to use (default: default)
--model str events.Event Django model to query, in app_label.ModelName format (default: events.Event)
--filter str [] Django ORM filter expression, e.g. 'field__lookup=value'
--exclude str [] Django ORM exclude expression, e.g. 'field__lookup=value'
--select str — Django ORM select expression, e.g. '["field1", "field2"]'
--order-by str — Django ORM order by expression, e.g. '["-field1", "field2"]'
--limit int — Limit the number of results returned

groupby

GroupBy command for aggregating data. Examples: groupby --keys='["field1", "field2"]' --out='count' groupby --keys='["field1", "Sum(field2)"]' --out='sum'

Argument Type Default Description
--keys str — Python list/tuple literal of fields/expressions to group by, e.g. '["field1", "field2", "expr"]'
--out str count Name of the output aggregated field (default: count)

annotate

Annotate command for adding calculated fields. Examples: annotate --set='avg_duration=Avg("duration")' --set='lower_host=Lower("host")'

Argument Type Default Description
--set str [] Set field to expression (e.g., --set='new_field=Func(arg)'), can be used multiple times. Supports placeholders ${fieldname}.

to_dataframe

ToDataFrame command for converting input data to pandas DataFrame.

This command accepts no arguments.

explode

Explode command for flattening top-level keys of a JSON field into separate columns. Examples: explode --field=data

Argument Type Default Description
--field str — The field containing JSON data to explode (e.g., --field=data). Top-level keys become new columns prefixed with the field name.

event_split

Split each item in an array field into a separate event.

Argument Type Default Description
--field str — Array field to split into separate events, e.g. --field=tags

drop

Remove one or more fields from a result set.

Examples: drop --fields='["raw", "internal_id"]'

Argument Type Default Description
--fields str — Fields to remove, e.g. '["field1", "field2"]'

select

Keep only selected fields in a result set.

Example: select --fields='["host", "source"]'

Argument Type Default Description
--fields str — Fields to keep, e.g. '["field1", "field2"]'

fillnull

Replace null values in a result field.

Example: fillnull --field=host --value=unknown

Argument Type Default Description
--field str — Field whose null values to replace
--value str — Replacement value

No description provided.

Argument Type Default Description
name str — Name of the SavedSearch to run
--events str — Optional events data to pass to pipeline
--request str — Optional request object

filter

Filter command for applying additional filtering conditions. Examples: filter --condition='host="server1"' filter --condition='created__gte="2025-10-01"' filter --condition='event_data__event_id=4625'

Argument Type Default Description
--condition str — Django ORM filter expression (e.g., 'host="server1"' or 'created__gte="2025-10-01"')

sort

Sort command for ordering data by fields. Examples: sort --fields='["created", "host"]' sort --fields='["-created"]' # descending

Argument Type Default Description
--fields str — Fields to sort by as a list, e.g. '["field1", "-field2"]' (use '-' prefix for descending)

Head command for getting the first N rows. Examples: head --n=10

Argument Type Default Description
--n int 10 Number of rows to return (default: 10)

tail

Tail command for getting the last N rows. Examples: tail --n=10

Argument Type Default Description
--n int 10 Number of rows to return (default: 10)

unique

Unique command for getting distinct values for fields.

Keeps only the named fields, like SQL SELECT DISTINCT; all other columns are dropped. Use dedup to keep one full row per group of values instead.

Examples: unique --fields='["host"]' unique --fields='["host", "sourcetype"]'

Argument Type Default Description
--fields str — Fields to get unique values for, e.g. '["field1", "field2"]'

dedup

Dedup command for keeping one full row per group of field values.

Unlike unique, keeps every column, not just the named fields. Use --keep to choose the first or last occurrence within each group.

Examples: dedup --fields='["host"]' dedup --fields='["host"]' --keep='last'

Argument Type Default Description
--fields str — Fields whose combined values define a group, e.g. '["field1", "field2"]'
--keep str first Which occurrence to keep within each group (default: first)

rename

Rename command for renaming columns. Examples: rename --mapping='{"old_name": "new_name", "field2": "field_two"}'

Argument Type Default Description
--mapping str — Dictionary mapping old names to new names, e.g. '{"old_name": "new_name"}'

stats

Stats command for computing statistics over a result set. Examples: stats --aggregations='["count"]' stats --aggregations='["count", "avg(duration)", "max(size)"]' --by='["host"]' stats --aggregations='["sum(bytes)", "min(bytes)", "max(bytes)"]' --by='["source", "destination"]'

Argument Type Default Description
--aggregations str — Python list literal of aggregation expressions. Count, Sum, Avg, Min, and Max work for all backends; StdDev and Variance require QuerySets. Function names are case-insensitive.
--by str — Python list literal of fields to group by, e.g. '["field1", "field2"]'

join

Join command for combining data from current pipeline with another dataset. Examples: join --model='events.Event' --on='["field1", "field2"]' --how='left' --using='other_db' --filter='host="server1"'

Argument Type Default Description
--model str events.Event Django model to query for the join data, in app_label.ModelName format (default: events.Event)
--filter str [] Django ORM filter expression for join data, e.g. 'field__lookup=value'
--exclude str [] Django ORM exclude expression for join data, e.g. 'field__lookup=value'
--select str — Django ORM select expression for join data, e.g. '["field1", "field2"]'
--on str — List of fields to join on, e.g. '["field1", "field2"]'
--how str left Type of join (default: left)
--using str default Database alias for the joined data (default: default)
--limit int — Limit the number of results returned