Shell Commands


The following is a run down of all commands that are available from the Loggly shell.


Displays this list of shell commands


search <search terms>

Searches for events with the given terms in the current context. Example:

hoover@example> search 404


graph <search terms>

Graphs events matching the given terms in the current context. Graph takes the same arguments as the search command. Example:

hoover@example> graph 404


graphjson <json.key_1>,<json.key_2>,…,<json.key_n> <query>

Graph numeric values from your JSON data results. Provide the keys of the values you want to plot and a search query. The x-axis uses the Loggly time stamp and the y-axis uses the numeric value of the specified JSON field. Example:

hoover@example> graphjson,, json.yellow:22


compare <terms1>, <terms2> [,<terms3>, …]

Graphs one or more series events, each matching given terms in the current context. Example:

hoover@example> compare apples, oranges, mangoes

With JSON formatted data, you can take this a step further. Try comparing values such as error codes or response times:

hoover@example> compare json.errorcode:[200 TO 299],json.errorcode:[300 TO 399],json.errorcode:[400 TO 499]


Returns a full numbered list of your shell command history.


Clears the screen.


set <setting> <value>

Sets the given setting to a new value. Valid settings are “from”, “until”, “order”, “rows”

"from": [date spec]
"until": [date spec]
"order": ["asc" or "desc"], for ascending and descending time sort order respectively
"rows": [integer], number of results to return per page


hoover@example> set from NOW-7DAYS


reset <setting>

Resets the given setting to its default value. Hint: Use this command if you feel like you're not getting the results you expect and want to start over. “reset all” sets all settings to their default values. Example:

hoover@example> reset from


uniq <facet> [<facet>:<search term>]
uniq json.<facet> [json.<facet>:<search term>]

Generates a list of unique elements in a set of data and returns a count for each element. Including a search filter is optional.

With unstructured data, there are only two facets available, inputname and ip:

hoover@example> uniq inputname
count   inputname
8,112    webheads
3,721    django
2,908    monitor
hoover@example> uniq ip
count     ip

With structured JSON data, you can facet on any field:

hoover@example> uniq json.status json.request:"GET / HTTP/1.1"
count   json.status
6938    200
2014    403
20      500
5       404


savedsearch [name]
ss [name]
savedgraph [name]
sg [name]

Once you've saved some searches, you can choose to view either search results or a graph. To see what saved searches you have available, omit the search name.


show beaver


Exits to the dashboard.