Follow

Source Query Language

Pulse’s source query language provides a mechanism for creating dynamic lists of sources which are in turn used in source filter definitions, dashboard legend searches, and source selections.   Where within Pulse the queries can be used is discussed here.  

Available search criteria are:

  • source name patterns, and;
  • the relative time since data was last seen from the sources.

For example, to create a filter that includes all sources that contain the text “prod” which have been active in the last two hours you would cre-ate a filter with the query:

prod && last: 2h

Wildcard Queries

By default, queries are implied substring searches.  Examples follow.

prod

This query returns all sources that contain “prod” in the source name.  Matched sources would include:

  • service-24.prod.domain.com
  • prod.domain.com
  • prod
  • source-prod
*prod*

This is an explicit version of the previous example.  The wild-carding is explicitly defined but has the same effect of returning all sources that contain the string.

prod*

This query searches for “sources that start with” and would match:

  • prod.domain.com
  • prod
*prod

This query searches for “sources that end with” and would match:

  • prod
  • source-prod
prod.*.com

This query would have the following valid matches:

  • service-24.prod.domain.com
  • prod.domain.com

Exact Match

To find a specific source that must be an exact match, one must surround the string search with double quotes.  For example:

"service-24.prod.domain.com"

This query will return a source which has a name "service-24.prod.domain.com".

Relative Active Time

To find sources that have reported within the last few hours you can use the following query:

last: 24h

This query will return all sources that have been active in the last 24 hours.

Relative Active Time with comparisons

Alternatively this same time modifier can be written like the following:

last > 24h

The following query will return all sources that have not been active in the last 2 hours.

last < 2h

Binary Comparison "AND" Queries

This query will return only the matching sources that matched in our implicit wildcard query example earlier which have sent data within the last 2 hours:

prod && last: 2h

Alternatively you can use the word “AND” which has the exact same effect:

prod and last: 2h

Binary Comparison "OR" Queries

This query will return the matching sources from our implicit wildcard query example as well as any other sources that have been active within the last 2 hours:

prod || last: 2h

Alternatively, you can use the word “OR” which has the exact same effect:

prod or last: 2h

Chained Comparison Queries:

This query is effectively processed like ((prod || staging) && last: 24h) due to typical order of operations.

prod || staging && last: 24h
Have more questions? Submit a request