Skip to main content

Quick Access Commands

Shortcut commands for frequent operations. Each wraps a common SPL2 pattern into a single, easy-to-type command.

count​

Quick event count shortcut. Faster than query ... | stats count.

lynxdb count [filter] [flags]

Flags​

FlagShortDefaultDescription
--since-sRelative time range (e.g., 15m, 1h, 7d)

Examples​

# Count all events
lynxdb count

# Count errors
lynxdb count 'level=error'

# Count events in last hour
lynxdb count --since 1h

sample​

Show a sample of recent events, useful for exploring data structure.

lynxdb sample [count] [filter] [flags]

The first argument is parsed as a number (sample size, default 5). Any remaining arguments are treated as an SPL2 filter.

Flags​

FlagShortDefaultDescription
--since-sRelative time range

Examples​

# 5 random events (default)
lynxdb sample

# 10 events
lynxdb sample 10

# 5 nginx events
lynxdb sample 5 'source=nginx'

# JSON for inspecting structure
lynxdb sample 3 --format json | jq .

last​

Re-run the most recently executed query. Optionally override the time range or output format.

lynxdb last [flags]

Flags​

FlagShortDefaultDescription
--since-sOverride time range

Examples​

# Repeat last query
lynxdb last

# Same query, wider time range
lynxdb last --since 24h

# Same query, CSV output
lynxdb last -F csv

fields​

Show the field catalog from server -- all known fields with types, coverage, and top values.

lynxdb fields [name] [flags]

Alias: f

When a field name is provided, shows details for that specific field (with fuzzy matching for typos). Use --values to see the top 50 values for a field.

Flags​

FlagShortDefaultDescription
--valuesfalseShow top values for the specified field
--since-sRestrict stats to time range (e.g., 15m, 1h, 7d)
--fromAbsolute start time (ISO 8601)
--toAbsolute end time (ISO 8601)
--sourceFilter by source
--prefixFilter fields by name prefix

Examples​

# All fields
lynxdb fields

# Detail for 'status' field
lynxdb fields status

# Top values for 'status'
lynxdb fields status --values

# Fields seen from nginx
lynxdb fields --source nginx

# Autocomplete helper
lynxdb fields --prefix sta

# Fields seen in last hour
lynxdb fields --since 1h

# JSON output for scripting
lynxdb fields --format json

Console Output​

FIELD                     TYPE       COVERAGE   TOP VALUES
--------------------------------------------------------------------------------
_time                     timestamp    100%
host                      string       100%     web-01(40%), api-01(35%), db-01(25%)
level                     string        95%     INFO(70%), WARN(20%), ERROR(10%)
status                    number        80%     200(60%), 404(15%), 500(5%)

7 fields total

explain​

Show query execution plan without running the query.

lynxdb explain [SPL2 query] [flags]

Flags​

FlagDefaultDescription
--analyzefalseExecute query and show plan with actual execution stats

Examples​

# Show plan
lynxdb explain 'level=error | stats count by source'

# JSON format
lynxdb explain 'status>=500 | top 10 uri' --format json

# Execute and show actual stats
lynxdb explain --analyze 'level=error | stats count'

Console Output​

Plan:
  FROM -> WHERE -> STATS

Estimated cost: low

Fields read: level, source

examples​

Show a cookbook of common SPL2 query patterns.

lynxdb examples

Alias: cookbook

Displays categorized examples for:

  • Search and Filter
  • Aggregation
  • Time Analysis
  • Transformation
  • Local File Queries

Run this command when you need a quick reference for SPL2 syntax and patterns.

See Also​