SELECT Statements

A SELECT statement can consist of the following basic clauses.

SELECT
INTO
FROM
JOIN
WHERE
GROUP BY
HAVING
UNION
ORDER BY
LIMIT

SELECT Syntax

The following syntax diagram outlines the syntax supported by the Splunk adapter:

SELECT {
  [ TOP <numeric_literal> | DISTINCT ]
  { 
    * 
    | { 
        <expression> [ [ AS ] <column_reference> ] 
        | { <table_name> | <correlation_name> } .* 
      } [ , ... ] 
  }
  { 
    FROM <table_reference> [ [ AS ] <identifier> ] 
  } [ , ... ]
  [ 
    JOIN <table_reference> [ ON <search_condition> ] [ [ AS ] <identifier> ] 
  ] [ ... ] 
  [ WHERE <search_condition> ]
  [ GROUP BY <column_reference> [ , ... ]
  [ HAVING <search_condition> ]
  [ UNION  [ ALL ] <select_statement> ]
  [ 
    ORDER BY 
    <column_reference> [ ASC | DESC ] [ NULLS FIRST | NULLS LAST ]
  ]
  [
    LIMIT <expression>
    [ 
      { OFFSET | , }
      <expression> 
    ]
  ] 
} | SCOPE_IDENTITY() 

  <expression> ::=
    | <column_reference>
    | @ <parameter> 
    | ?
    | COUNT( * | { [ DISTINCT ] <expression> } )
    | { AVG | MAX | MIN | SUM | COUNT } ( <expression> ) 
    | NULLIF ( <expression> , <expression> ) 
    | COALESCE ( <expression> , ... ) 
    | CASE <expression>
        WHEN { <expression> | <search_condition> } THEN { <expression> | NULL } [ ... ]
    [ ELSE { <expression> | NULL } ]
      END 
    | <literal>
    | <sql_function> 

  <search_condition> ::= 
    {
      <expression> { = | < | > | >= | <= | != | AND | OR | NOT | IN | IS | NULL | IS | NOT | NULL } [ <expression> ]
    } [ { AND | OR } ... ]

Examples

Return all columns:
```
SELECT * FROM DataModels
```

Rename a column:

SELECT "Owner" AS MY_Owner FROM DataModels

Cast a column's data as a different data type:

SELECT CAST(DatasetLimiting AS VARCHAR) AS Str_DatasetLimiting FROM DataModels

Search data:

SELECT * FROM DataModels WHERE Id = 'SampleDataset'

The Splunk APIs support the following operators in the WHERE clause: =, <, >, >=, <=, !=, AND, OR, NOT, IN, IS, NULL, IS, NOT, NULL.
```
SELECT * FROM DataModels WHERE Id = 'SampleDataset';
```
Return the number of items matching the query criteria:
```
SELECT COUNT(*) AS MyCount FROM DataModels 
```
Return the number of unique items matching the query criteria:
```
SELECT COUNT(DISTINCT Owner) FROM DataModels 
```
Return the unique items matching the query criteria:
```
SELECT DISTINCT Owner FROM DataModels 
```

Sort a result set in ascending order:

SELECT Name, Owner FROM DataModels  ORDER BY Owner ASC

Aggregate Functions

For SELECT examples using aggregate functions, see Aggregate Functions.

JOIN Queries

See JOIN Queries for SELECT query examples using JOINs.

Date Literal Functions

Date Literal Functions contains SELECT examples with date literal functions.

Projection Functions

See Projection Functions for SELECT examples with projection functions.

Window Functions

See Window Functions for SELECT examples containing window functions.

Table-Valued Functions

See Table-Valued Functions for SELECT examples with table-valued functions.

TDV Adapter for Splunk