View data: audit datamodel dbinspect eventcount metadata typeahead Manage data: delete Manage summary indexes: collect stash overlap sichart sirare sistats sitimechart sitop Add fields: accum addinfo addtotals delta eval iplocation lookup multikv rangemap relevancy strcat Extract fields: erex extract kv kvform rex spath xmlkv Modify fields: convert filldown fillnull makemv nomv reltime rename replace Find anomalies: analyifields af anomalies anomalousvalue anomalydetection cluster kmeans outlier rare Geographic and location: iplocation geom geomfilter geostats Metrics: mcollect meventcollect mpreview msearch mstats Prediction and trending: predict trendline x11 Reports: addtotals autoregress bin discretize chart contingency counttable ctable correlate eventcount eventstats gauge makecontinuous mstats outlier rare stats streamstats timechart top trendline tstats untable xyseries Results: sendemail append appendcols appendpipe arules associate contingency counttable ctable correlate diff join selfjoin lookup set stats transaction Filtering: dedup fields from mvcombine regex searchtxn table uniq where Formatting: fieldformat transpose untable xyseries Generating: gentimes loadjob makeresults mvexpand savedsearch search Grouping: cluster kmeans mvexpand transaction typelearner typer Reordering: head reverse sort tail Reading: inputcsv inputlookup loadjob Writing: collect stash meventcollect mcollect outputcsv outputlookup outputtext sendemail Search: localop map redistribute search sendemail Subsearch: append appendcols appendpipe foreach format join return set Time: gentimes localize reltime