test_conf.json

{
	"selection": [["search"],["error"],"*"],
	"test_cases": {
		"basic_search": {
			"search":"index=\"idx\" sourcetype=logs event_id IN (1,3)",
			"exp_err":0,
			"tags":["search","valid"]
		},
		"basic_search_2": {
			"search":"index=idx\" sourcetype=logs event_id IN (1,3)",
			"exp_err":1,
			"tags":["search","error"]
			},
		"simple_stats": {
			"search":"index=\"idx\" | stats count by sourcetype",
			"exp_err":0,
			"tags":["search","stats","valid"]
		},
		"simple_stats_with_renaming": {
			"search":"index=\"idx\" | stats count values(host) as hosts_list by sourcetype",
			"exp_err":0,
			"tags":["search","stats","valid"]
		},
		"simple_stats_with_renaming_and_args": {
			"search":"index=\"idx\" | stats partitions=2 delim=\".\" count values(host) as hosts_list by sourcetype",
			"exp_err":0,
			"tags":["search","stats","args","valid"]
		},
		"simple_stats_with_wrong_args": {
			"search":"index=\"idx\" | stats delimiter=2 count values(host) as hosts_list by sourcetype",
			"exp_err":1,
			"tags":["search","stats","args","error"]
		},
		"simple_eval": {
			"search":"index=\"idx\" | eval success=if(result=1,true,false)",
			"exp_err":0,
			"tags":["search","eval","valid"]
		},
		"simple_accum": {
			"search":"index=\"idx\" | accum score as sum_score",
			"exp_err":0,
			"tags":["search","accum","valid"]
		},
		"simple_accum_with_error": {
			"search":"index=\"idx\" | accum score sum_score",
			"exp_err":1,
			"tags":["search","accum","valid"]
		},
		"splunk_abstract": {
			"search":"index=\"idx\" |abstract maxlines=5",
			"exp_err":0,
			"tags":["search","abstract","valid","splunk_doc"]
		},
		"splunk_accum": {
			"search":"sourcetype=access_* status=200 categoryId=STRATEGY | chart count AS views by productId | accum views as TotalViews",
			"exp_err":0,
			"tags":["search","accum","valid","splunk_doc","chart"]
		},
		"splunk_addcoltotals_1": {
			"search":"index=idx | addcoltotals labelfield=change_name label=ALL",
			"exp_err":0,
			"tags":["search","addcoltotals","valid","splunk_doc"]
		},
		"splunk_addcoltotals_2": {
			"search":"sourcetype=access_* | table userId bytes avgTime duration | addcoltotals bytes duration",
			"exp_err":0,
			"tags":["search","addcoltotals","valid","splunk_doc","table"]
		},
		"splunk_addcoltotals_3": {
			"search":"index=idx | fields user*, *size | addcoltotals *size",
			"exp_err":0,
			"tags":["search","addcoltotals","valid","splunk_doc","fields"]
		},
		"splunk_addcoltotals_4": {
			"search":"index=_internal source=\"metrics.log\" group=pipeline | stats avg(cpu_seconds) by processor | addcoltotals labelfield=processor",
			"exp_err":0,
			"tags":["search","addcoltotals","valid","splunk_doc","stats"]
		},
		"splunk_accum_1": {
			"search":"index=idx | addinfo",
			"exp_err":0,
			"tags":["search","addinfo","valid","splunk_doc"]
		},
		"splunk_accum_2": {
			"search":"index=idx | stats latest(_time) AS latest_time BY host | addinfo | eval latest_age = info_max_time - latest_time | fields - info_* | inputlookup append=t expected_hosts | fillnull value=9999 latest_age | dedup host | where latest_age > 42",
			"exp_err":0,
			"tags":["search","addinfo","valid","splunk_doc","stats","dedup","eval","fields","inputlookup","fillnull","where"]
		},
		"splunk_addtotals_1": {
			"search":"source=\"addtotalsData.csv\" | chart sum(sales) BY products quarter | addtotals",
			"exp_err":0,
			"tags":["search","addtotals","valid","splunk_doc","chart"]
		},
		"splunk_addtotals_2": {
			"search":"index=idx | addtotals fieldname=sum",
			"exp_err":0,
			"tags":["search","addtotals","valid","splunk_doc"]
		},
		"splunk_addtotals_3": {
			"search":"index=idx | addtotals fieldname=TotalAmount amount* *size*",
			"exp_err":0,
			"tags":["search","addtotals","valid","splunk_doc"]
		},
		"splunk_addtotals_4": {
			"search":"source=\"addtotalsData.csv\" | stats sum(quota) by quarter| addtotals row=f col=t labelfield=quarter sum(quota)",
			"exp_err":0,
			"tags":["search","addtotals","valid","splunk_doc","stats"]
		},
		"splunk_addtotals_5": {
			"search":"source=\"addtotalsData.csv\" | chart sum(sales) by products quarter| addtotals col=t labelfield=products label=\"Quarterly Totals\" fieldname=\"Product Totals\"",
			"exp_err":0,
			"tags":["search","addtotals","valid","splunk_doc","chart"]
		},
		"splunk_analyzefields": {
			"search":"index=idx | analyzefields classfield=is_activated",
			"exp_err":0,
			"tags":["search","analyzefields","valid","splunk_doc"]
		},
		"splunk_anomalies_1": {
			"search":"index=idx | anomalies list=boringevents | sort -unexpectedness",
			"exp_err":0,
			"tags":["search","anomalies","valid","splunk_doc","sort"]
		},
		"splunk_anomalies_2": {
			"search":"index=idx | transaction maxpause=2s | anomalies",
			"exp_err":0,
			"tags":["search","anomalies","valid","splunk_doc","transaction"]
		},
		"splunk_anomalies_3": {
			"search":"index=idx | anomalies by source",
			"exp_err":0,
			"tags":["search","anomalies","valid","splunk_doc"]
		},
		"splunk_anomalies_4": {
			"search":"index=_internal | anomalies BY group | search group=*",
			"exp_err":0,
			"tags":["search","anomalies","valid","splunk_doc"]
		},
		"splunk_anomalousvalue_1": {
			"search":"index=_internal | anomalousvalue",
			"exp_err":0,
			"tags":["search","anomalousvalue","valid","splunk_doc"]
		},
		"splunk_anomalousvalue_2": {
			"search":"index=_internal | anomalousvalue action=filter pthresh=0.02",
			"exp_err":0,
			"tags":["search","anomalousvalue","valid","splunk_doc"]
		},
		"splunk_anomalydetection_1": {
			"search":"index=_internal | anomalydetection",
			"exp_err":0,
			"tags":["search","anomalydetection","valid","splunk_doc"]
		},
		"splunk_anomalydetection_2": {
			"search":"index=_internal | anomalydetection method=histogram action=filter",
			"exp_err":0,
			"tags":["search","anomalydetection","valid","splunk_doc"]
		},
		"splunk_anomalydetection_3": {
			"search":"index=_internal | anomalydetection action=summary",
			"exp_err":0,
			"tags":["search","anomalydetection","valid","splunk_doc"]
		},
		"splunk_anomalydetection_4": {
			"search":"index=_internal | anomalydetection method=zscore action=filter pthresh=0.05",
			"exp_err":0,
			"tags":["search","anomalydetection","valid","splunk_doc"]
		},
		"splunk_anomalydetection_5": {
			"search":"index=_internal | anomalydetection method=iqr action=tf param=4 uselower=true mark=true",
			"exp_err":0,
			"tags":["search","anomalydetection","valid","splunk_doc"]
		},
		"splunk_append_1": {
			"search":"source=usgs place=*California* | stats count by magType | append [search index=usgs_* source=usgs place=*California* | stats count]",
			"exp_err":0,
			"tags":["search","append","valid","splunk_doc","stats","subsearch"]
		},
		"splunk_append_2": {
			"search":"sourcetype=access_* action=purchase | stats dc(clientip) BY categoryId | append [search sourcetype=access_* action=purchase | top 1 clientip BY categoryId] | table categoryId, dc(clientip), clientip, count",
			"exp_err":0,
			"tags":["search","append","valid","splunk_doc","stats","subsearch","top"]
		},
		"splunk_append_3": {
			"search":"sourcetype=access_* | stats dc(clientip), count by method | append maxtime=30 maxout=1000 [search sourcetype=access_* | top 1 clientip by method]",
			"exp_err":0,
			"tags":["search","append","valid","splunk_doc","stats","subsearch","top"]
		},
		"splunk_append_4": {
			"search":"index=_internal earliest=11/20/2017:00:00:00 latest=11/30/2017:00:00:00 |append extendtimerange=true [search index=_audit earliest=11/1/2017:00:00:00 latest=11/25/2017:00:00:00] |timechart span=1d count",
			"exp_err":0,
			"tags":["search","append","valid","splunk_doc","stats","subsearch","timechart","date_field"]
		},
		"splunk_appendcol_1": {
			"search":"source=usgs place=*California* | appendcols [search 404]",
			"exp_err":0,
			"tags":["search","appendcol","valid","splunk_doc","subsearch"]
		},
		"splunk_appendcol_2": {
			"search":"index=idx | stats dc(userID) as totalUsers | appendcols [ search index=idx AND \"text\" | addinfo | where _time >= info_min_time AND _time <=info_max_time | stats count(field) as variableA ] | eval variableB = exact(variableA/totalUsers)",
			"exp_err":0,
			"tags":["search","appendcol","valid","splunk_doc","subsearch","stats","addinfo","where","eval"]
		},
		"splunk_appendpipe": {
			"search":"index=_audit | stats count by action user | appendpipe [stats sum(count) as count by action | eval user = \"TOTAL - ALL USERS\"] | sort action",
			"exp_err":0,
			"tags":["search","appendpipe","valid","splunk_doc","subsearch","stats","eval","sort"]
		},
		"splunk_arules_1": {
			"search":"index=idx | arules field1 field2 field3",
			"exp_err":0,
			"tags":["search","arules","valid","splunk_doc"]
		},
		"splunk_arules_2": {
			"search":"index=idx | arules sup=3 conf=.6 field1 field2 field3",
			"exp_err":0,
			"tags":["search","arules","valid","splunk_doc"]
		},
		"splunk_associate_1": {
			"search":"sourcetype=access_* status!=200 | fields method, status | associate improv=0.05 | table Reference_Key, Reference_Value, Target_Key, Top_Conditional_Value, Description",
			"exp_err":0,
			"tags":["search","associate","valid","splunk_doc","fields","table"]
		},
		"splunk_associate_2": {
			"search":"index=_internal sourcetype=splunkd | associate supcnt=3",
			"exp_err":0,
			"tags":["search","associate","valid","splunk_doc"]
		},
		"splunk_associate_3": {
			"search":"host=\"reports\" | associate supcnt=50 supfreq=0.2 improv=0.5",
			"exp_err":0,
			"tags":["search","associate","valid","splunk_doc"]
		},
		"splunk_audit": {
			"search":"index=idx | audit",
			"exp_err":0,
			"tags":["search","audit","valid","splunk_doc"]
		},
		"splunk_autoregress_1": {
			"search":"index=idx | autoregress ip AS old_ip p=3",
			"exp_err":0,
			"tags":["search","autoregress","valid","splunk_doc"]
		},
		"splunk_autoregress_2": {
			"search":"index=idx | autoregress count p=2-5",
			"exp_err":0,
			"tags":["search","autoregress","valid","splunk_doc"]
		},
		"splunk_autoregress_3": {
			"search":"index=idx | eval rawlen=len(_raw) | autoregress rawlen p=1-4 | eval moving_average=(rawlen + rawlen_p1 + rawlen_p2 + rawlen_p3 +rawlen_p4 ) /5",
			"exp_err":0,
			"tags":["search","autoregress","valid","splunk_doc","eval"]
		},
		"splunk_bin_1": {
			"search":"index=idx | bin _time span=5m | stats avg(thruput) by _time host",
			"exp_err":0,
			"tags":["search","bin","valid","splunk_doc","stats"]
		},
		"splunk_bin_2": {
			"search":"index=idx | bin size bins=10 | stats count(_raw) by size",
			"exp_err":0,
			"tags":["search","bin","valid","splunk_doc","stats"]
		},
		"splunk_bin_3": {
			"search":"index=idx | bin amount end=1000",
			"exp_err":0,
			"tags":["search","bin","valid","splunk_doc"]
		},
		"splunk_bin_4": {
			"search":"index=idx | bin _time span=12h aligntime=@d+3h",
			"exp_err":0,
			"tags":["search","bin","valid","splunk_doc"]
		},
		"splunk_bin_5": {
			"search":"index=idx | bin _time aligntime=1500567890",
			"exp_err":0,
			"tags":["search","bin","valid","splunk_doc"]
		},
		"splunk_bucketdir": {
			"search":"index=idx | top source | bucketdir pathfield=source sizefield=count maxcount=10",
			"exp_err":0,
			"tags":["search","bucketdir","valid","splunk_doc","top"]
		},
		"splunk_chart_1": {
			"search":"index=idx | chart max(delay) OVER foo",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_1": {
			"search":"index=idx | chart max(delay) OVER foo",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_2": {
			"search":"index=idx | chart max(delay) OVER foo BY bar",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_3": {
			"search":"index=idx | chart eval(avg(size)/max(delay)) AS ratio BY host user",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_4": {
			"search":"index=idx | chart max(delay) BY size bins=10",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_5": {
			"search":"index=idx | chart avg(size) BY host",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_6": {
			"search":"index=idx | chart count BY date_mday span=3 date_hour span=12",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_8": {
			"search":"index=idx | chart avg(field) BY mvfield dedup_splitvals=true",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_9": {
			"search":"source=\"addtotalsData.csv\" | chart sum(sales) BY products quarter",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_10": {
			"search":"sourcetype=access_* | chart count(eval(method=\"GET\")) AS GET, count(eval(method=\"POST\")) AS POST by host",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc"]
		},
		"splunk_chart_11": {
			"search":"sourcetype=access_* status=200 action=purchase | transaction clientip maxspan=10m | chart count BY duration span=log2",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc","transaction"]
		},
		"splunk_chart_12": {
			"search":"sourcetype=access_* status=200 action=purchase | transaction clientip maxspan=30m | chart avg(eventcount) by duration span=log2",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc","transaction"]
		},
		"splunk_chart_13": {
			"search":"sourcetype=access_* status=200 action=purchase | chart dc(clientip) OVER date_hour BY categoryId usenull=f",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc","transaction"]
		},
		"splunk_chart_14": {
			"search":"source=all_month.csv place=*alaska* mag>=3.5 | chart count BY mag place useother=f | rename mag AS Magnitude",
			"exp_err":0,
			"tags":["search","chart","valid","splunk_doc","transaction"]
		},
		"splunk_cluster_1": {
			"search":"index=_internal source=*splunkd.log* log_level!=info | cluster showcount=t | table cluster_count _raw | sort -cluster_count",
			"exp_err":0,
			"tags":["search","cluster","valid","splunk_doc","table","sort"]
		},
		"splunk_cluster_2": {
			"search":"index=idx | cluster t=0.9 showcount=t | sort - cluster_count | head 20",
			"exp_err":0,
			"tags":["search","cluster","valid","splunk_doc","head","sort"]
		},
		"splunk_cluster_3": {
			"search":"index=idx | cluster labelonly=t showcount=t | sort - cluster_count, cluster_label, _time | dedup 5 cluster_label",
			"exp_err":0,
			"tags":["search","cluster","valid","splunk_doc","dedup","sort"]
		},
		"splunk_collect_1": {
			"search":"eventtypetag=\"download\" | collect index=downloadcount",
			"exp_err":0,
			"tags":["search","collect","valid","splunk_doc"]
		},
		"splunk_collect_2": {
			"search":"index=mysummary | eval country_source=if(REMOTE_IP_country_code=\"US\",\"domestic\",\"foreign\") | bin _time span=1h | stats count by _time,vpn_action,country_source | addinfo | collect index=mysummary marker=\"summary_type=vpn, summary_span=3600, summary_method=bin, search_name=\\\"vpn starts and stops\\\"\"",
			"exp_err":0,
			"tags":["search","collect","valid","splunk_doc","eval","bin","stats","addinfo"]
		},
		"splunk_concurrency_1": {
			"search":"index=_internal sourcetype=splunkd_ui_access | eval spent_in_seconds = spent / 1000 | concurrency duration=spent_in_seconds",
			"exp_err":0,
			"tags":["search","concurrency","valid","splunk_doc","eval"]
		},
		"splunk_concurrency_2": {
			"search":"index=idx | concurrency duration=total_time output=foo",
			"exp_err":0,
			"tags":["search","concurrency","valid","splunk_doc"]
		},
		"splunk_concurrency_3": {
			"search":"index=idx | concurrency duration=length start=et",
			"exp_err":0,
			"tags":["search","concurrency","valid","splunk_doc"]
		},
		"splunk_concurrency_4": {
			"search":"sourcetype=access_* | transaction JSESSIONID clientip startswith=\"view\" endswith=\"purchase\" | concurrency duration=duration | eval duration=tostring(duration,\"duration\")",
			"exp_err":0,
			"tags":["search","concurrency","valid","splunk_doc","transaction","eval"]
		},
		"splunk_contingency_1": {
			"search":"source=all_month.csv | contingency mag depth | sort mag",
			"exp_err":0,
			"tags":["search","contingency","valid","splunk_doc","sort"]
		},
		"splunk_contingency_2": {
			"search":"index=_internal | contingency maxcols=5 log_level component",
			"exp_err":0,
			"tags":["search","contingency","valid","splunk_doc"]
		},
		"splunk_convert_1": {
			"search":"index=idx | convert auto(*)",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc"]
		},
		"splunk_convert_2": {
			"search":"index=idx | convert auto(*) none(foo)",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc"]
		},
		"splunk_convert_3": {
			"search":"index=idx | convert dur2sec(xdelay) dur2sec(delay)",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc"]
		},
		"splunk_convert_4": {
			"search":"index=idx | convert dur2sec(delay)",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc"]
		},
		"splunk_convert_5": {
			"search":"index=idx | convert rmunit(duration)",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc"]
		},
		"splunk_convert_6": {
			"search":"index=idx | convert memk(virt)",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc"]
		},
		"splunk_convert_7": {
			"search":"index=idx source=\"all_month.csv\" | convert timeformat=\"%H:%M:%S\" ctime(_time) AS c_time | table _time, c_time",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc","table"]
		},
		"splunk_convert_8": {
			"search":"sourcetype=syslog | convert mstime(_time) AS ms_time | table _time, ms_time",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc","table"]
		},
		"splunk_convert_9": {
			"search":"index=idx | convert num(time_elapsed) | stats sum(eval(time_elapsed/60)) AS Minutes BY user_id",
			"exp_err":0,
			"tags":["search","convert","valid","splunk_doc","stats"]
		},
		"splunk_datamodel_1": {
			"search":"| datamodel",
			"exp_err":0,
			"tags":["datamodel","valid","splunk_doc"]
		},
		"splunk_datamodel_2": {
			"search":"| datamodel internal_audit_logs",
			"exp_err":0,
			"tags":["datamodel","valid","splunk_doc"]
		},
		"splunk_datamodel_3": {
			"search":"| datamodel Tutorial Client_errors",
			"exp_err":0,
			"tags":["datamodel","valid","splunk_doc"]
		},
		"splunk_datamodel_4": {
			"search":"| datamodel Tutorial Client_errors search",
			"exp_err":0,
			"tags":["datamodel","valid","splunk_doc"]
		},
		"splunk_datamodel_5": {
			"search":"| datamodel Tutorial Client_errors search | search Tutorial.status=404 | stats count",
			"exp_err":0,
			"tags":["datamodel","valid","splunk_doc","search","stats"]
		},
		"splunk_datamodel_6": {
			"search":"| datamodel Tutorial summariesonly=true search | timechart span=1h count",
			"exp_err":0,
			"tags":["datamodel","valid","splunk_doc","search","timechart"]
		},
		"splunk_dbinspect_1": {
			"search":"| dbinspect index=_internal span=1d",
			"exp_err":0,
			"tags":["dbinspect","valid","splunk_doc"]
		},
		"splunk_dbinspect_2": {
			"search":"| dbinspect index=_internal corruptonly=true",
			"exp_err":0,
			"tags":["dbinspect","valid","splunk_doc"]
		},
		"splunk_dbinspect_3": {
			"search":"| dbinspect index=_internal | stats count by splunk_server",
			"exp_err":0,
			"tags":["dbinspect","valid","splunk_doc","stats"]
		},
		"splunk_dbinspect_4": {
			"search":"| dbinspect index=_internal | eval GB=sizeOnDiskMB/1024| stats sum(GB)",
			"exp_err":0,
			"tags":["dbinspect","valid","splunk_doc","eval","stats"]
		},
		"splunk_dedup_1": {
			"search":"index=imap invalid | dedup host",
			"exp_err":0,
			"tags":["search","dedup","valid","splunk_doc"]
		},
		"splunk_dedup_2": {
			"search":"index=imap invalid | dedup source sortby +_time",
			"exp_err":0,
			"tags":["search","dedup","valid","splunk_doc"]
		},
		"splunk_dedup_3": {
			"search":"index=imap invalid | dedup source sortby -_size",
			"exp_err":0,
			"tags":["search","dedup","valid","splunk_doc"]
		},
		"splunk_dedup_4": {
			"search":"index=imap invalid | dedup 3 source",
			"exp_err":0,
			"tags":["search","dedup","valid","splunk_doc"]
		},
		"splunk_dedup_5": {
			"search":"index=imap invalid | dedup 2 source host",
			"exp_err":0,
			"tags":["search","dedup","valid","splunk_doc"]
		},
		"splunk_dedup_6": {
			"search":"index=imap invalid | dedup consecutive=true source host",
			"exp_err":0,
			"tags":["search","dedup","valid","splunk_doc"]
		},
		"splunk_delete_1": {
			"search":"index=insecure | regex _raw = \"\\d{3}-\\d{2}-\\d{4}\" | delete",
			"exp_err":0,
			"tags":["search","delete","valid","splunk_doc","regex"]
		},
		"splunk_delete_2": {
			"search":"index=imap invalid | delete",
			"exp_err":0,
			"tags":["search","delete","valid","splunk_doc"]
		},
		"splunk_delete_3": {
			"search":"source=tutorialdata.zip:* | delete",
			"exp_err":0,
			"tags":["search","delete","valid","splunk_doc"]
		},
		"splunk_delta_1": {
			"search":"sourcetype=tv activity=\"View\" | sort - _time | delta _time AS timeDeltaS | eval timeDeltaS=abs(timeDeltaS) | stats sum(timeDeltaS) by ChannelName",
			"exp_err":0,
			"tags":["search","delta","valid","splunk_doc","sort","eval","stats"]
		},
		"splunk_delta_2": {
			"search":"index=idx | delta count p=3",
			"exp_err":0,
			"tags":["search","delta","valid","splunk_doc"]
		},
		"splunk_delta_3": {
			"search":"index=idx | delta count AS countdiff",
			"exp_err":0,
			"tags":["search","delta","valid","splunk_doc"]
		},
		"splunk_delta_4": {
			"search":"sourcetype=access_* status=200 action=purchase | top clientip | delta count p=1",
			"exp_err":0,
			"tags":["search","delta","valid","splunk_doc"]
		},
		"splunk_delta_5": {
			"search":"source=all_month.csv place=*alaska* | delta _time p=1 | rename delta(_time) AS timeDeltaS | eval timeDeltaS=abs(timeDeltaS) | eval \"Time Between Quakes\"=tostring(timeDeltaS,\"duration\") | table place, _time, \"Time Between Quakes\"",
			"exp_err":0,
			"tags":["search","delta","valid","splunk_doc","rename","eval","table"]
		},
		"splunk_delta_6": {
			"search":"sourcetype=access_* | transaction JSESSIONID clientip startswith=\"view\" endswith=\"purchase\" | delta _time AS timeDelta p=1 | eval timeDelta=abs(timeDelta) | eval timeDelta=tostring(timeDelta,\"duration\")",
			"exp_err":0,
			"tags":["search","delta","valid","splunk_doc","transaction","eval"]
		},
		"splunk_diff_1": {
			"search":"index=idx | diff pos1=1 pos2=3 attribute=ip",
			"exp_err":0,
			"tags":["search","diff","valid","splunk_doc"]
		},
		"splunk_diff_2": {
			"search":"index=idx | diff position1=9 position2=10",
			"exp_err":0,
			"tags":["search","diff","valid","splunk_doc"]
		},
		"splunk_erex_1": {
			"search":"index=idx | erex monthday examples=\"7/01\"",
			"exp_err":0,
			"tags":["search","erex","valid","splunk_doc"]
		},
		"splunk_erex_2": {
			"search":"index=idx | erex monthday examples=\"7/01, 07/02\" counterexamples=\"99/2\"",
			"exp_err":0,
			"tags":["search","erex","valid","splunk_doc"]
		},
		"splunk_erex_3": {
			"search":"sourcetype=secure* port \"failed password\" | erex port examples=\"port 3351, port 3768\" | top port",
			"exp_err":0,
			"tags":["search","erex","valid","splunk_doc","top"]
		},
		"splunk_eval_1": {
			"search":"index=idx | eval velocity=distance/time",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_2": {
			"search":"index=idx | eval error = if(status == 200, \"OK\", \"Problem\")",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_3": {
			"search":"index=idx | eval 'low-user' = lower(username)",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_4": {
			"search":"index=perfmon sourcetype=Perfmon* counter=* Value=* | eval {counter} = Value",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_5": {
			"search":"index=idx | eval sum_of_areas = pi() * pow(radius_a, 2) + pi() * pow(radius_b, 2)",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_6": {
			"search":"index=idx | eval error_msg = case(error == 404, \"Not found\", error == 500, \"Internal Server Error\", error == 200, \"OK\")",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_7": {
			"search":"index=idx | eval full_name = first_name.\" \".last_name",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_8": {
			"search":"index=idx | eval full_name = first_name.\" \".last_name, low_name = lower(full_name)",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_9": {
			"search":"index=idx | eval x=\"$\".tostring(x,\"commas\")",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_10": {
			"search":"sourcetype=A OR sourcetype=B | eval phone=coalesce(number,subscriberNumber) | transaction phone maxspan=2m",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc","transaction"]
		},
		"splunk_eval_11": {
			"search":"source=all_month.csv | eval Description=case(depth<=70, \"Shallow\", depth>70 AND depth<=300, \"Mid\", depth>300, \"Deep\") | stats count min(mag) max(mag) by Description",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_12": {
			"search":"sourcetype=access_* | eval network=if(cidrmatch(\"182.236.164.11/16\", clientip), \"local\", \"other\")",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc"]
		},
		"splunk_eval_13": {
			"search":"sourcetype=\"cisco:esa\" mailfrom=* | eval accountname=split(mailfrom,\"@\"), from_user=mvindex(accountname,0), from_domain=mvindex(accountname,-1) | table mailfrom, from_user, from_domain",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc","table"]
		},
		"splunk_eval_14": {
			"search":"sourcetype=\"cisco:esa\" mailfrom=*| eval accountname=split(mailfrom,\"@\"), from_domain=mvindex(accountname,-1), location=if(match(from_domain, \"[^\n\r\\s]+\\.(com|net|org)\"), \"local\", \"abroad\") | stats count BY location",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc","stats"]
		},
		"splunk_eval_15": {
			"search":"sourcetype=access_* | transaction clientip maxspan=10m | eval durationstr=tostring(duration,\"duration\")",
			"exp_err":0,
			"tags":["search","eval","valid","splunk_doc","transaction"]
		},
		"splunk_eventcount_1": {
			"search":"| eventcount",
			"exp_err":0,
			"tags":["eventcount","valid","splunk_doc"]
		},
		"splunk_eventcount_2": {
			"search":"| eventcount summarize=false index=_* report_size=true",
			"exp_err":0,
			"tags":["eventcount","valid","splunk_doc"]
		},
		"splunk_eventcount_3": {
			"search":"| eventcount summarize=false index=* index=_*",
			"exp_err":0,
			"tags":["eventcount","valid","splunk_doc"]
		},
		"splunk_eventstats_1": {
			"search":"host=www1 | transaction clientip host maxspan=30s maxpause=5s | eventstats avg(duration) AS avgdur",
			"exp_err":0,
			"tags":["search","eventstats","valid","splunk_doc","transaction"]
		},
		"splunk_eventstats_2": {
			"search":"host=www1 | transaction clientip host maxspan=30s maxpause=5s | eventstats avg(duration) As avgdur BY date_minute",
			"exp_err":0,
			"tags":["search","eventstats","valid","splunk_doc","transaction"]
		},
		"splunk_eventstats_3": {
			"search":"eventtype=\"error\" | eventstats avg(bytes) AS avg | where bytes>avg",
			"exp_err":0,
			"tags":["search","eventstats","valid","splunk_doc","where"]
		},
		"splunk_eventstats_4": {
			"search":"| makeresults count=4 | streamstats count | eval age = case(count=1, 25, count=2, 39, count=3, 31, count=4, \"test\") | eval city = case(count=1 OR count=3, \"San Francisco\", count=2 OR count=4, \"Seattle\") | eventstats allnum=true avg(age) BY city",
			"exp_err":0,
			"tags":["search","eventstats","valid","splunk_doc","makeresults","streamstats","eval"]
		},
		"splunk_extract_1": {
			"search":"index=idx | extract pairdelim=\"|;\" kvdelim=\"=:\"",
			"exp_err":0,
			"tags":["search","extract","valid","splunk_doc"]
		},
		"splunk_extract_2": {
			"search":"index=idx | extract reload=true",
			"exp_err":0,
			"tags":["search","extract","valid","splunk_doc"]
		},
		"splunk_extract_3": {
			"search":"index=idx | rename _raw AS temp uri_query AS _raw | extract pairdelim=\"?&\" kvdelim=\"=\" | rename _raw AS uri_query temp AS _raw",
			"exp_err":0,
			"tags":["search","extract","valid","splunk_doc","rename"]
		},
		"splunk_extract_4": {
			"search":"index=idx | extract access-extractions",
			"exp_err":0,
			"tags":["search","extract","valid","splunk_doc"]
		},
		"splunk_fieldformat_1": {
			"search":"index=idx | table sourcetype totalCount | fieldformat totalCount=tostring(totalCount, \"commas\")",
			"exp_err":0,
			"tags":["search","fiedformat","valid","splunk_doc","table"]
		},
		"splunk_fieldformat_2": {
			"search":"index=idx | fieldformat start_time = strftime(start_time, \"%H:%M:%S\")",
			"exp_err":0,
			"tags":["search","fiedformat","valid","splunk_doc"]
		},
		"splunk_fieldformat_3": {
			"search":"index=idx | fieldformat totalSales=\"$\".tostring(totalSales,\"commas\")",
			"exp_err":0,
			"tags":["search","fiedformat","valid","splunk_doc"]
		},
		"splunk_fieldformat_4": {
			"search":"index=idx | rename totalCount as Count firstTime as \"First Event\" lastTime as \"Last Event\" recentTime as \"Last Update\" | table sourcetype Count \"First Event\" \"Last Event\" \"Last Update\" | fieldformat Count=tostring(Count, \"commas\") | fieldformat \"First Event\"=strftime('First Event', \"%c\") | fieldformat \"Last Event\"=strftime('Last Event', \"%c\") | fieldformat \"Last Update\"=strftime('Last Update', \"%c\")",
			"exp_err":0,
			"tags":["search","fiedformat","valid","splunk_doc","rename","table"]
		},
		"splunk_fields_1": {
			"search":"index=idx | fields - host, ip",
			"exp_err":0,
			"tags":["search","fields","valid","splunk_doc"]
		},
		"splunk_fields_2": {
			"search":"index=idx | fields host, ip | fields - _*",
			"exp_err":0,
			"tags":["search","fields","valid","splunk_doc"]
		},
		"splunk_fields_3": {
			"search":"index=_internal sourcetype=\"splunkd\" | head 5 | fields - _raw _indextime _sourcetype _subsecond _serial | outputcsv MyTestCsvfile",
			"exp_err":0,
			"tags":["search","fields","valid","splunk_doc","head","outputcsv"]
		},
		"splunk_fields_4": {
			"search":"index=idx | fields source, sourcetype, host, error*",
			"exp_err":0,
			"tags":["search","fields","valid","splunk_doc"]
		},
		"splunk_fieldsummary_1": {
			"search":"index=_internal earliest=-15m latest=now | fieldsummary",
			"exp_err":0,
			"tags":["search","fieldsummary","valid","splunk_doc"]
		},
		"splunk_fieldsummary_2": {
			"search":"index=_internal earliest=-15m latest=now | fieldsummary maxvals=10 *size* *count*",
			"exp_err":0,
			"tags":["search","fieldsummary","valid","splunk_doc"]
		},
		"splunk_fielddown_1": {
			"search":"index=idx | filldown",
			"exp_err":0,
			"tags":["search","fielddown","valid","splunk_doc"]
		},
		"splunk_fielddown_2": {
			"search":"index=idx | filldown count",
			"exp_err":0,
			"tags":["search","fielddown","valid","splunk_doc"]
		},
		"splunk_fielddown_3": {
			"search":"index=idx | filldown count score*",
			"exp_err":0,
			"tags":["search","fielddown","valid","splunk_doc"]
		},
		"splunk_findtypes_1": {
			"search":"index=idx | findtypes",
			"exp_err":0,
			"tags":["search","findtypes","valid","splunk_doc"]
		},
		"splunk_findtypes_2": {
			"search":"index=idx | findtypes max=50 useraw",
			"exp_err":0,
			"tags":["search","findtypes","valid","splunk_doc"]
		},
		"splunk_folderize_1": {
			"search":"index=_internal | stats count(uri) by uri | folderize size=count(uri) attr=uri sep=\"/\"",
			"exp_err":0,
			"tags":["search","folderize","valid","splunk_doc"]
		},
		"splunk_foreach_1": {
			"search":"|makeresults | eval total=0 | eval test1=1 | eval test2=2 | eval test3=3 | foreach test* [eval total=total + <<FIELD>>]",
			"exp_err":0,
			"tags":["makeresults","foreach","valid","splunk_doc","eval"]
		},
		"splunk_foreach_2": {
			"search":"index=_internal source=*license_usage.log type!=\"*Summary\" earliest=-30d | timechart span=1d sum(b) AS daily_bytes by st | foreach * [eval <<FIELD>>='<<FIELD>>'/1024/1024/1024]",
			"exp_err":0,
			"tags":["search","foreach","valid","splunk_doc","timechart"]
		},
		"splunk_foreach_3": {
			"search":"index=idx | foreach foo* [eval new_<<MATCHSTR>> = <<FIELD>> + bar<<MATCHSTR>>]",
			"exp_err":0,
			"tags":["search","foreach","valid","splunk_doc"]
		},
		"splunk_foreach_4": {
			"search":"index=idx | foreach foo bar baz [eval <<FIELD>> = \"<<FIELD>>\"]",
			"exp_err":0,
			"tags":["search","foreach","valid","splunk_doc"]
		},
		"splunk_foreach_5": {
			"search":"index=idx | foreach foo*bar* fieldstr=\"#field#\" matchseg2=\"#matchseg2#\" [eval \"#field#\" = \"#matchseg2#\"]",
			"exp_err":0,
			"tags":["search","foreach","valid","splunk_doc"]
		},
		"splunk_format_1": {
			"search":"index=idx | head 2 | fields source, sourcetype, host | format",
			"exp_err":0,
			"tags":["search","format","valid","splunk_doc","head","findtypes"]
		},
		"splunk_format_2": {
			"search":"index=idx | format \"[\" \"[\" \"&&\" \"]\" \"||\" \"]\"",
			"exp_err":0,
			"tags":["search","format","valid","splunk_doc"]
		},
		"splunk_format_3": {
			"search":"index=_internal |head 1 |eval foo=\"eventtype,log_level\" | makemv delim=\",\" foo | fields foo | format mvsep=\"mvseparator\" \"{\" \"[\" \"AND\" \"]\" \"AND\" \"}\"",
			"exp_err":0,
			"tags":["search","format","valid","splunk_doc","head","eval","makemv","fields"]
		},
		"splunk_from_1": {
			"search":"| from datamodel:internal_server.splunkdaccess",
			"exp_err":0,
			"tags":["from","valid","splunk_doc"]
		},
		"splunk_from_2": {
			"search":"| from lookup geo_attr_countries.csv",
			"exp_err":0,
			"tags":["from","valid","splunk_doc"]
		},
		"splunk_from_3": {
			"search":"| from lookup:kvstorecoll_lookup | where (CustID>500) AND (CustName=\"P*\") | stats count",
			"exp_err":0,
			"tags":["from","valid","splunk_doc","where","stats"]
		},
		"splunk_from_4": {
			"search":"| from savedsearch:mysecurityquery | fields _time clientip",
			"exp_err":0,
			"tags":["from","valid","splunk_doc","fields"]
		},
		"splunk_from_5": {
			"search":"| from savedsearch \"Top five sourcetypes\"",
			"exp_err":0,
			"tags":["from","valid","splunk_doc"]
		},
		"splunk_gauge_1": {
			"search":"index=_internal | stats count as myCount | gauge myCount 750 1000 1250 1500",
			"exp_err":0,
			"tags":["search","gauge","valid","splunk_doc","stats"]
		},
		"splunk_gentimes_1": {
			"search":"| gentimes start=4/1/18 end=4/5/18",
			"exp_err":0,
			"tags":["gentimes","valid","splunk_doc"]
		},
		"splunk_gentimes_2": {
			"search":"| gentimes start=-30 end=-27",
			"exp_err":0,
			"tags":["gentimes","valid","splunk_doc"]
		},
		"splunk_gentimes_3": {
			"search":"| gentimes start=12/1/17 end=12/5/17 increment=1h",
			"exp_err":0,
			"tags":["gentimes","valid","splunk_doc"]
		},
		"splunk_gentimes_4": {
			"search":"| gentimes start=9/25/17",
			"exp_err":0,
			"tags":["gentimes","valid","splunk_doc"]
		},
		"splunk_gentimes_5": {
			"search":"| gentimes start=12/1/17 end=4/30/18 increment=7d",
			"exp_err":0,
			"tags":["gentimes","valid","splunk_doc"]
		},
		"splunk_geom_1": {
			"search":"index=idx | stats count | eval featureId=\"California\" | eval count=10000 | geom geo_us_states allFeatures=true",
			"exp_err":0,
			"tags":["search","geom","valid","splunk_doc","stats","eval"]
		},
		"splunk_geom_2": {
			"search":"index=idx | geom",
			"exp_err":0,
			"tags":["search","geom","valid","splunk_doc"]
		},
		"splunk_geom_3": {
			"search":"index=idx | geom geo_us_states",
			"exp_err":0,
			"tags":["search","geom","valid","splunk_doc"]
		},
		"splunk_geom_4": {
			"search":"index=idx | geom geo_us_states featureIdField=\"state\"",
			"exp_err":0,
			"tags":["search","geom","valid","splunk_doc"]
		},
		"splunk_geom_5": {
			"search":"index=idx | geom geo_us_states allFeatures=true",
			"exp_err":0,
			"tags":["search","geom","valid","splunk_doc"]
		},
		"splunk_geom_6": {
			"search":"index=idx | lookup geo_countries latitude AS lat, longitude AS long | stats count BY featureIdField | geom geo_countries featureIdField=\"country\"",
			"exp_err":0,
			"tags":["search","geom","valid","splunk_doc","lookup","stats"]
		},
		"splunk_geom_7": {
			"search":"index=idx | geom geo_us_states featureIdField=\"state\" gen=0.1 min_x=-130.5 min_y=37.6 max_x=-130.1 max_y=37.7",
			"exp_err":0,
			"tags":["search","geom","valid","splunk_doc","stats","eval"]
		},
		"splunk_geomfilter_1": {
			"search":"index=idx | geomfilter",
			"exp_err":0,
			"tags":["search","geomfilter","valid","splunk_doc"]
		},
		"splunk_geomfilter_2": {
			"search":"index=idx | geomfilter min_x=-90 min_y=-90 max_x=90 max_y=90",
			"exp_err":0,
			"tags":["search","geomfilter","valid","splunk_doc"]
		},
		"splunk_geostats_1": {
			"search":"index=idx | geostats count",
			"exp_err":0,
			"tags":["search","geostats","valid","splunk_doc"]
		},
		"splunk_geostats_2": {
			"search":"index=idx | geostats latfield=eventlat longfield=eventlong avg(rating) by gender",
			"exp_err":0,
			"tags":["search","geostats","valid","splunk_doc"]
		},
		"splunk_geostats_3": {
			"search":"sourcetype=vendor_sales | stats count by Code VendorID | lookup prices_lookup Code OUTPUTNEW product_name | table product_name VendorID | lookup vendors_lookup VendorID | geostats latfield=VendorLatitude longfield=VendorLongitude count by product_name",
			"exp_err":0,
			"tags":["search","geostats","valid","splunk_doc","stats","table","lookup"]
		},
		"splunk_head_1": {
			"search":"index=idx | head 20",
			"exp_err":0,
			"tags":["search","head","valid","splunk_doc"]
		},
		"splunk_head_2": {
			"search":"index=idx | head 20",
			"exp_err":0,
			"tags":["search","head","valid","splunk_doc"]
		},
		"splunk_head_3": {
			"search":"| makeresults count=7 | streamstats count | eval count=if(count=3,null(), count) | head count<5 keeplast=true null=true",
			"exp_err":0,
			"tags":["makeresults","head","valid","splunk_doc","streamstats","eval"]
		},
		"splunk_highlight_1": {
			"search":"index=idx | highlight login,logout",
			"exp_err":0,
			"tags":["search","highlight","valid","splunk_doc"]
		},
		"splunk_highlight_2": {
			"search":"index=idx | highlight \"access denied\"",
			"exp_err":0,
			"tags":["search","highlight","valid","splunk_doc"]
		},
		"splunk_history_1": {
			"search":"| history",
			"exp_err":0,
			"tags":["history","valid","splunk_doc"]
		},
		"splunk_history_2": {
			"search":"| history events=true",
			"exp_err":0,
			"tags":["history","valid","splunk_doc"]
		},
		"splunk_iconify_1": {
			"search":"index=idx | iconify eventtype",
			"exp_err":0,
			"tags":["search","iconify","valid","splunk_doc"]
		},
		"splunk_iconify_2": {
			"search":"index=idx | iconify clientip method",
			"exp_err":0,
			"tags":["search","iconify","valid","splunk_doc"]
		},
		"splunk_inputcsv_1": {
			"search":"| inputcsv all.csv | search error | outputcsv errors.csv",
			"exp_err":0,
			"tags":["inputcsv","valid","splunk_doc","search","outputcsv"]
		},
		"splunk_inputcsv_2": {
			"search":"| inputcsv start=100 max=500 bar",
			"exp_err":0,
			"tags":["inputcsv","valid","splunk_doc"]
		},
		"splunk_inputcsv_3": {
			"search":"| inputcsv students.csv WHERE (age>=13 age<=19) AND NOT age=16 | stats count",
			"exp_err":0,
			"tags":["inputcsv","valid","splunk_doc","stats"]
		},
		"splunk_inputcsv_4": {
			"search":"error earliest=-d@d | inputcsv append=true all_errors.csv | outputcsv all_errors.csv",
			"exp_err":0,
			"tags":["search","inputcsv","valid","splunk_doc","search","outputcsv"]
		},
		"splunk_inputcsv_5": {
			"search":"| inputcsv file1.csv | eval source=\"file1\" | append [inputcsv file2.csv | eval source=\"file2\"]",
			"exp_err":0,
			"tags":["inputcsv","valid","splunk_doc","search","eval","append","subsearch"]
		},
		"splunk_iplocation_1": {
			"search":"sourcetype=access_* | iplocation clientip",
			"exp_err":0,
			"tags":["search","iplocation","valid","splunk_doc"]
		},
		"splunk_iplocation_2": {
			"search":"sourcetype=access_* status>=400 | head 20 | iplocation clientip | table clientip, status, City, Country",
			"exp_err":0,
			"tags":["search","iplocation","valid","splunk_doc","head","table"]
		},
		"splunk_iplocation_3": {
			"search":"sourcetype = access_* | iplocation prefix=iploc_ allfields=true clientip | fields iploc_*",
			"exp_err":0,
			"tags":["search","iplocation","valid","splunk_doc","fields"]
		},
		"splunk_join_1": {
			"search":"index=idx | join product_id [search vendors]",
			"exp_err":0,
			"tags":["search","join","valid","splunk_doc","subsearch"]
		},
		"splunk_join_2": {
			"search":"index=idx | join product_id [search vendors | rename pid AS product_id]",
			"exp_err":0,
			"tags":["search","join","valid","splunk_doc","subsearch","rename"]
		},
		"splunk_join_3": {
			"search":"index=idx | join product_id max=0 [search vendors]",
			"exp_err":0,
			"tags":["search","join","valid","splunk_doc","subsearch"]
		},
		"splunk_kmeans_1": {
			"search":"index=idx | kmeans k=4 date_hour date_minute",
			"exp_err":0,
			"tags":["search","kmeans","valid","splunk_doc"]
		},
		"splunk_kmeans_2": {
			"search":"index=idx | kmeans",
			"exp_err":0,
			"tags":["search","kmeans","valid","splunk_doc"]
		},
		"splunk_kvform_1": {
			"search":"index=idx | kvform form=sales_order",
			"exp_err":0,
			"tags":["search","kvform","valid","splunk_doc"]
		},
		"splunk_kvform_2": {
			"search":"index=idx | kvform field=sourcetype",
			"exp_err":0,
			"tags":["search","kvform","valid","splunk_doc"]
		},
		"splunk_kvform_3": {
			"search":"index=idx | kvform field=eventtype",
			"exp_err":0,
			"tags":["search","kvform","valid","splunk_doc"]
		},
		"splunk_loadjob_1": {
			"search":"| loadjob savedsearch=\"admin:search:MySavedSearch\"",
			"exp_err":0,
			"tags":["loadjob","valid","splunk_doc"]
		},
		"splunk_loadjob_2": {
			"search":"| loadjob 1233886270.2 events=true",
			"exp_err":0,
			"tags":["loadjob","valid","splunk_doc"]
		},
		"splunk_localize_1": {
			"search":"index=idx | localize maxpause=5m | map search=\"search failure starttimeu=$starttime$ endtimeu=$endtime$\"",
			"exp_err":0,
			"tags":["search","localize","valid","splunk_doc","map"]
		},
		"splunk_localize_2": {
			"search":"index=idx | localize | map search=\"search starttimeu::$starttime$ endtimeu::$endtime$ | transaction uid,qid maxspan=1h\"",
			"exp_err":0,
			"tags":["search","localize","valid","splunk_doc","map"]
		},
		"splunk_localop_1": {
			"search":"FOO BAR | localop | iplocation clientip",
			"exp_err":0,
			"tags":["search","localop","valid","iplocation"]
		},
		"splunk_makecontinuous_1": {
			"search":"index=idx | makecontinuous _time span=10m",
			"exp_err":0,
			"tags":["search","makecontinuous","valid","splunk_doc"]
		},
		"splunk_makemv_1": {
			"search":"eventtype=\"sendmail\" | makemv delim=\",\" senders | top senders",
			"exp_err":0,
			"tags":["search","makemv","valid","splunk_doc","top"]
		},
		"splunk_makemv_2": {
			"search":"index=idx | makemv delim=\":\" allowempty=true foo",
			"exp_err":0,
			"tags":["search","makemv","valid","splunk_doc"]
		},
		"splunk_makemv_3": {
			"search":"| makeresults | eval my_multival=\"one,two,three\" | makemv tokenizer=\"([^,]+),?\" my_multival",
			"exp_err":0,
			"tags":["makeresults","makemv","valid","splunk_doc","eval"]
		},
		"splunk_makeresults_1": {
			"search":"| makeresults | eval newfield=\"some value\"",
			"exp_err":0,
			"tags":["makeresults","valid","splunk_doc","eval"]
		},
		"simple_makeresults_1": {
			"search":"| makeresults count=5 annotate=true",
			"exp_err":0,
			"tags":["makeresults","valid"]
		},
		"splunk_map_1": {
			"search":"index=idx | localize | map mytimebased_savedsearch",
			"exp_err":0,
			"tags":["search","map","valid","splunk_doc","localize"]
		},
		"splunk_map_2": {
			"search":"index=idx | map search=\"search starttimeu::$start$ endtimeu::$end$\" maxsearches=10",
			"exp_err":0,
			"tags":["search","map","valid","splunk_doc"]
		},
		"splunk_map_3": {
			"search":"sourcetype=syslog sudo | stats count by user host | map search=\"search index=ad_summary username=$user$ type_logon=ad_last_logon\"",
			"exp_err":0,
			"tags":["search","map","valid","splunk_doc","stats"]
		},
		"splunk_mcollect_1": {
			"search":"index=\"_audit\" search_id info total_run_time | stats count(search_id) as jobs avg(total_run_time) as latency by user | rename jobs as metric_name:jobs latency as metric_name:latency | mcollect index=mcollect_test",
			"exp_err":0,
			"tags":["search","mcollect","valid","splunk_doc","stats","rename"]
		},
		"splunk_mcollect_2": {
			"search":"index=\"_audit\" info=completed | stats max(total_run_time) as runtime max(event_count) as events by user | mcollect index=mcollect_test split=t user",
			"exp_err":0,
			"tags":["search","mcollect","valid","splunk_doc","stats"]
		},
		"splunk_metadata_1": {
			"search":"| metadata type=hosts index=cs* index=na* index=ap* index=eu*",
			"exp_err":0,
			"tags":["metadata","valid","splunk_doc"]
		},
		"splunk_metadata_2": {
			"search":"| metadata type=sourcetypes index=_internal",
			"exp_err":0,
			"tags":["metadata","valid","splunk_doc"]
		},
		"splunk_metadata_3": {
			"search":"| metadata type=sourcetypes index=_internal | rename totalCount as Count firstTime as \"First Event\" lastTime as \"Last Event\" recentTime as \"Last Update\" | fieldformat Count=tostring(Count, \"commas\") | fieldformat \"First Event\"=strftime('First Event', \"%c\") | fieldformat \"Last Event\"=strftime('Last Event', \"%c\") | fieldformat \"Last Update\"=strftime('Last Update', \"%c\")",
			"exp_err":0,
			"tags":["metadata","valid","splunk_doc","rename","fieldformat"]
		},
		"splunk_metadata_4": {
			"search":"| metadata type=sourcetypes index=_audit splunk_server=foo",
			"exp_err":0,
			"tags":["metadata","valid","splunk_doc"]
		},
		"splunk_metasearch_1": {
			"search":"| metasearch 404 host=\"webserver1\"",
			"exp_err":0,
			"tags":["metasearch","valid","splunk_doc"]
		},
		"splunk_meventcollect_1": {
			"search":"index=_internal source=*/metrics.log | eval prefix = group + \".\" + name | meventcollect index=my_metric_index split=true prefix_field=prefix name group",
			"exp_err":0,
			"tags":["search","meventcollect","valid","splunk_doc"]
		},
		"splunk_mpreview_1": {
			"search":"| mpreview index=_metrics filter=\"group=queue name=indexqueue metric_name=*.current_size\"",
			"exp_err":0,
			"tags":["mpreview","valid","splunk_doc"]
		},
		"splunk_mpreview_2": {
			"search":"| mpreview index=_metrics",
			"exp_err":0,
			"tags":["mpreview","valid","splunk_doc"]
		},
		"splunk_mpreview_3": {
			"search":"| mpreview index=_metrics chunk_size=100",
			"exp_err":0,
			"tags":["mpreview","valid","splunk_doc"]
		},
		"splunk_mpreview_4": {
			"search":"| mpreview index=_metrics target_per_timeseries=5",
			"exp_err":0,
			"tags":["mpreview","valid","splunk_doc"]
		},
		"splunk_mstats_1": {
			"search":"| mstats avg(aws.ec2.CPUUtilization) WHERE index=mymetricdata span=30s",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc"]
		},
		"splunk_mstats_2": {
			"search":"| mstats avg(aws.ec2.CPUUtilization) avg(os.cpu.utilization) WHERE index=mymetricdata BY host span=1m",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc"]
		},
		"splunk_mstats_3": {
			"search":"| mstats chart=t count(aws.ec2.CPUUtilization) WHERE index=mymetricdata by host span=1d chart.limit=top10",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc"]
		},
		"splunk_mstats_4": {
			"search":"| mstats avg(aws.ec2.CPUUtilization) WHERE host=foo BY app",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc"]
		},
		"splunk_mstats_5": {
			"search":"| mstats avg(os.mem.rss) AS \"AverageRSS\" max(os.mem.rss) AS \"MaxRSS\" avg(os.mem.vsz) AS \"AverageVMS\" max(os.mem.vsz) AS \"MaxVMS\" WHERE index=mymetricdata BY metric_name span=1m",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc"]
		},
		"splunk_mstats_6": {
			"search":"| mstats median(aws.ec2.CPUUtilization) span=1m every=5m",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc"]
		},
		"splunk_mstats_7": {
			"search":"| mstats rate(spl.intr.resource_usage.PerProcess.data.elapsed) as data.elapsed where index=_metrics BY _timeseries | rename _timeseries AS timeseries",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc","rename"]
		},
		"splunk_mstats_8": {
			"search":"| mstats count(_value) WHERE metric_name=aws.ec2.CPUUtilization AND index=mymetricdata",
			"exp_err":0,
			"tags":["mstats","valid","splunk_doc"]
		},
		"splunk_multikv_1": {
			"search":"index=idx | multikv fields COMMAND filter splunkd",
			"exp_err":0,
			"tags":["search","multikv","valid","splunk_doc"]
		},
		"splunk_multikv_2": {
			"search":"index=idx | multikv fields pid command",
			"exp_err":0,
			"tags":["search","multikv","valid","splunk_doc"]
		},
		"splunk_multisearch_1": {
			"search":"| multisearch [search index=a | eval type = \"foo\"] [search index=b | eval mytype = \"bar\"]",
			"exp_err":0,
			"tags":["multisearch","valid","splunk_doc"]
		},
		"splunk_mvcombine_1": {
			"search":"index=* host=www* | stats max(bytes) AS max, min(bytes) AS min BY host | mvcombine host",
			"exp_err":0,
			"tags":["search","mvcombine","valid","splunk_doc","stats"]
		},
		"splunk_mvcombine_2": {
			"search":"index=* host=www* | stats max(bytes) AS max, min(bytes) AS min BY host | mvcombine delim=\",\" host | nomv host",
			"exp_err":0,
			"tags":["search","mvcombine","valid","splunk_doc","stats","nomv"]
		},
		"splunk_mvcomine_3": {
			"search":"sourcetype=\"WMI:WinEventLog:Security\" | fields EventCode, Category,RecordNumber | mvcombine delim=\",\" RecordNumber | nomv RecordNumber",
			"exp_err":0,
			"tags":["search","mvcombine","valid","splunk_doc","fields","nomv"]
		},
		"splunk_mvcomine_4": {
			"search":"index=idx | mvcombine delim=\":\" foo",
			"exp_err":0,
			"tags":["search","mvcombine","valid","splunk_doc"]
		},
		"splunk_mvexpand_1": {
			"search":"index=idx | mvexpand foo",
			"exp_err":0,
			"tags":["search","mvexpand","valid","splunk_doc"]
		},
		"splunk_mvexpand_2": {
			"search":"index=idx | mvexpand foo limit=100",
			"exp_err":0,
			"tags":["search","mvexpand","valid","splunk_doc"]
		},
		"splunk_mvexpand_3": {
			"search":"source=\"mvexpandData.csv\" | rex field=_raw \"a=(?<a>\\d+)\" max_match=5 | rex field=_raw \"b=(?<b>\\d+)\" max_match=5 | eval fields = mvzip(a,b) | table _time fields",
			"exp_err":0,
			"tags":["search","mvexpand","valid","splunk_doc","rex","eval","fields","table"]
		},
		"splunk_nomv_1": {
			"search":"eventtype=\"sendmail\" | nomv senders | top senders",
			"exp_err":0,
			"tags":["search","nomv","valid","splunk_doc","top"]
		},
		"splunk_outlier_1": {
			"search":"404 host=\"webserver\" | timechart avg(cpu_seconds) by host | outlier action=tf",
			"exp_err":0,
			"tags":["search","outlier","valid","splunk_doc","timechart"]
		},
		"splunk_outlier_2": {
			"search":"index=idx | outlier",
			"exp_err":0,
			"tags":["search","outlier","valid","splunk_doc"]
		},
		"splunk_outputcsv_1": {
			"search":"index=idx | outputcsv mysearch",
			"exp_err":0,
			"tags":["search","outputcsv","valid","splunk_doc"]
		},
		"splunk_outputcsv_2": {
			"search":"| outputcsv [stats count | eval search=strftime(now(), \"mysearch-%y%m%d-%H%M%S.csv\")]",
			"exp_err":0,
			"tags":["search","outputcsv","valid","splunk_doc","subsearch","stats","eval"]
		},
		"splunk_outputcsv_3": {
			"search":"index=_internal sourcetype=\"splunkd\" | head 5 | fields _raw _time | fields - _indextime _sourcetype _subsecond _serial | outputcsv MyTestCsvfile",
			"exp_err":0,
			"tags":["search","outputcsv","valid","splunk_doc","head","fields"]
		},
		"splunk_outputcsv_4": {
			"search":"index=idx | outputcsv mysearch.csv override_if_empty=false",
			"exp_err":0,
			"tags":["search","outputcsv","valid","splunk_doc"]
		},
		"splunk_outputtext_1": {
			"search":"index=idx | outputtext",
			"exp_err":0,
			"tags":["search","outputtext","valid","splunk_doc"]
		},
		"splunk_pivot_1": {
			"search":"| pivot Tutorial HTTP_requests count(HTTP_requests) AS \"Count of HTTP requests\"",
			"exp_err":0,
			"tags":["pivot","valid","splunk_doc"]
		},
		"splunk_pivot_2": {
			"search":"| pivot Tutorial HTTP_requests count(HTTP_requests) AS \"Count\" SPLITROW host AS \"Server\" SORT 100 host",
			"exp_err":0,
			"tags":["pivot","valid","splunk_doc"]
		},
		"splunk_predict_1": {
			"search":"sourcetype=access_combined_* | timechart span=1d count(file) as count | predict count",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc","timechart"]
		},
		"splunk_predict_2": {
			"search":"sourcetype=access_* action=purchase arcade | timechart span=1d count | predict count",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc","timechart"]
		},
		"splunk_predict_3": {
			"search":"index=idx | timechart span=\"1m\" count AS foo | predict foo",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc","timechart"]
		},
		"splunk_predict_4": {
			"search":"index=idx | predict foo1 foo2 foo3",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc"]
		},
		"splunk_predict_5": {
			"search":"index=idx | timechart span=\"1m\" count AS foo | predict foo AS foobar algorithm=LL upper90=high lower97=low future_timespan=10 holdback=20",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc","timechart"]
		},
		"splunk_predict_6": {
			"search":"index=idx | timechart span=\"1m\" count(x) AS foo2 count(y) AS foo3 | predict foo3 AS foobar algorithm=LLB correlate=foo2 holdback=100",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc","timechart"]
		},
		"splunk_predict_7": {
			"search":"index=idx | predict foo holdback=5 future_timespan=5",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc"]
		},
		"splunk_predict_8": {
			"search":"index=idx | predict foo1 foo2 foo3 algorithm=LLT future_timespan=15 holdback=5",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc"]
		},
		"splunk_predict_9": {
			"search":"index=idx | predict foo1 AS foobar1 foo2 AS foobar2 foo3 AS foobar3 algorithm=LLT future_timespan=15 holdback=5",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc"]
		},
		"splunk_predict_10": {
			"search":"index=idx | predict foo1 algorithm=LL future_timespan=15 foo2 algorithm=LLP period=7 future_timespan=7",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc"]
		},
		"splunk_predict_11": {
			"search":"index=idx | predict foo1 foo2 algorithm=BiLL future_timespan=10",
			"exp_err":0,
			"tags":["search","predict","valid","splunk_doc"]
		},
		"splunk_rangemap_1": {
			"search":"index=idx | rangemap field=date_second green=1-30 blue=31-39 red=40-59 default=gray",
			"exp_err":0,
			"tags":["search","rangemap","valid","splunk_doc"]
		},
		"splunk_rangemap_2": {
			"search":"index=idx | rangemap field=count low=0-0 elevated=1-100 default=severe",
			"exp_err":0,
			"tags":["search","rangemap","valid","splunk_doc"]
		},
		"splunk_rangemap_3": {
			"search":"source=all_month.csv place=*alaska* mag>=3.5 | stats count BY mag | rename mag AS magnitude | rangemap field=magnitude green=3.9-4.2 yellow=4.3-4.6 red=4.7-5.0 default=gray | stats sum(count) by range | eval sort_field=case(range=\"red\",1, range=\"yellow\",2, range=\"green\",3, range=\"gray\",4) | sort sort_field",
			"exp_err":0,
			"tags":["search","rangemap","valid","splunk_doc","stats","rename","eval","sort"]
		},
		"splunk_rare_1": {
			"search":"index=idx | rare url limit=5",
			"exp_err":0,
			"tags":["search","rare","valid","splunk_doc"]
		},
		"splunk_rare_2": {
			"search":"index=idx | rare user by host",
			"exp_err":0,
			"tags":["search","rare","valid","splunk_doc"]
		},
		"splunk_redistribute_1": {
			"search":"index=idx | redistribute by ip | stats count by ip",
			"exp_err":0,
			"tags":["search","redistribute","valid","splunk_doc","stats"]
		},
		"splunk_redistribute_2": {
			"search":"index=idx | redistribute | eventstats count by user, source | where count>10 | sitimechart max(count) by source | timechart max(count) by source",
			"exp_err":0,
			"tags":["search","redistribute","valid","splunk_doc","eventstats","where","sitimechart","timechart"]
		},
		"splunk_redistribute_3": {
			"search":"| tstats prestats=t count BY _time span=1d | redistribute by _time | sitimechart span=1d count | timechart span=1d count",
			"exp_err":0,
			"tags":["tstats","redistribute","valid","splunk_doc","sitimechart","timechart"]
		},
		"splunk_redistribute_4": {
			"search":"index=idx | redistribute | eventstats count by user, source | where count >10 | sort 0 -num(count)",
			"exp_err":0,
			"tags":["search","redistribute","valid","splunk_doc","eventstats","where","sort"]
		},
		"splunk_redistribute_5": {
			"search":"index=idx | redistribute by source | eventstats count by source, host | where count > 10 | stats count by userid, host",
			"exp_err":0,
			"tags":["search","redistribute","valid","splunk_doc","eventstats","where","stats"]
		},
		"splunk_regex_1": {
			"search":"index=idx | regex _raw=\"(?<!\\d)10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}(?!\\d)\"",
			"exp_err":0,
			"tags":["search","regex","valid","splunk_doc"]
		},
		"splunk_regex_2": {
			"search":"index=idx | regex email=\"^([a-z0-9_\\.-]+)@([\\da-z\\.-]+)\\.([a-z\\.]{2,6})$\"",
			"exp_err":0,
			"tags":["search","regex","valid","splunk_doc"]
		},
		"splunk_relevancy_1": {
			"search":"disk error | relevancy | sort -relevancy",
			"exp_err":0,
			"tags":["search","relevancy","valid","splunk_doc","sort"]
		},
		"splunk_reltime_1": {
			"search":"index=idx | reltime",
			"exp_err":0,
			"tags":["search","reltime","valid","splunk_doc"]
		},
				"splunk_rename_1": {
			"search":"index=idx | rename _ip AS IPAddress",
			"exp_err":0,
			"tags":["search","rename","valid","splunk_doc"]
		},
		"splunk_rename_2": {
			"search":"index=idx | rename foo* AS bar*",
			"exp_err":0,
			"tags":["search","rename","valid","splunk_doc"]
		},
		"splunk_rename_3": {
			"search":"index=idx | rename count AS \"Count of Events\"",
			"exp_err":0,
			"tags":["search","rename","valid","splunk_doc"]
		},
		"splunk_replace_1": {
			"search":"index=idx | replace *localhost WITH localhost",
			"exp_err":0,
			"tags":["search","replace","valid","splunk_doc"]
		},
		"splunk_replace_2": {
			"search":"index=idx | replace 127.0.0.1 WITH localhost IN host",
			"exp_err":0,
			"tags":["search","replace","valid","splunk_doc"]
		},
		"splunk_replace_3": {
			"search":"index=idx | replace aug WITH August IN start_month end_month",
			"exp_err":0,
			"tags":["search","replace","valid","splunk_doc"]
		},
		"splunk_replace_4": {
			"search":"index=idx | replace \"* localhost\" WITH \"localhost *\" IN host",
			"exp_err":0,
			"tags":["search","replace","valid","splunk_doc"]
		},
		"splunk_replace_5": {
			"search":"index=idx | replace 0 WITH Critical, 1 WITH Error IN msg_level",
			"exp_err":0,
			"tags":["search","replace","valid","splunk_doc"]
		},
		"splunk_replace_6": {
			"search":"\"Error exporting to XYZ :\" | rex \"Error exporting to XYZ:(?.*)\" | replace \"\" WITH \" \" IN errmsg",
			"exp_err":0,
			"tags":["search","replace","valid","splunk_doc","rex"]
		},
		"splunk_replace_7": {
			"search":"sourcetype=* | head 5 | eval _time=\"XYZ\" | stats count BY _time | replace *XYZ* WITH *ALL* IN _time",
			"exp_err":0,
			"tags":["search","replace","valid","splunk_doc","head","eval","stats"]
		},
		"splunk_require_1": {
			"search":"index=idx | require",
			"exp_err":0,
			"tags":["search","require","valid","splunk_doc"]
		},
		"splunk_require_2": {
			"search":"index=idx [ search index=other_index NOSUCHVALUE | require ]",
			"exp_err":0,
			"tags":["search","require","valid","splunk_doc","subsearch"]
		},
		"splunk_rest_1": {
			"search":"| rest /services/search/jobs count=0 splunk_server=local | search isSaved=1",
			"exp_err":0,
			"tags":["rest","search","valid","splunk_doc"]
		},
		"splunk_rest_2": {
			"search":"| rest /services/saved/searches splunk_server=local | rename search AS saved_search | fields author, title, saved_search | search saved_search=*speccsv*",
			"exp_err":0,
			"tags":["rest","search","valid","splunk_doc","rename","fields"]
		},
		"splunk_rest_3": {
			"search":"* | head 10 | join [ | rest splunk_server=local /services/authentication/current-context | rename username as auth_user_id | fields auth_user_id ]",
			"exp_err":0,
			"tags":["rest","search","valid","splunk_doc","head","join","rename","fields","subsearch"]
		},
		"splunk_rest_4": {
			"search":"| rest /servicesNS/-/-/saved/searches splunk_server_group=dmc_group_search_head timeout=0 search=\"is_scheduled=1\" search=\"disabled=0\"",
			"exp_err":0,
			"tags":["rest","search","valid","splunk_doc"]
		},
		"splunk_return_1": {
			"search":"error [ search user=boss | return ip ]",
			"exp_err":0,
			"tags":["search","return","valid","splunk_doc","subsearch"]
		},
		"splunk_return_2": {
			"search":"error [ search login | return 2 user ip ]",
			"exp_err":0,
			"tags":["search","return","valid","splunk_doc","subsearch"]
		},
		"splunk_return_3": {
			"search":"index=idx | eval nextid = 1 + [ search user=* | return $id ]",
			"exp_err":0,
			"tags":["search","return","valid","splunk_doc","subsearch","eval"]
		},
		"splunk_rex_1": {
			"search":"index=idx | rex field=test max_match=0 \"((?<field>[^$]*)\\$(?<value>[^,]*),?)\"",
			"exp_err":0,
			"tags":["search","rex","valid","splunk_doc"]
		},
		"splunk_rex_2": {
			"search":"index=idx | rex field=test max_match=0 \"((?<field>[^$]*)\\$(?<value>[^,]*),?)\"",
			"exp_err":0,
			"tags":["search","rex","valid","splunk_doc"]
		},
		"splunk_rex_3": {
			"search":"index=idx | rex field=savedsearch_id \"(?<user>\\w+);(?<app>\\w+);(?<SavedSearchName>\\w+)\"",
			"exp_err":0,
			"tags":["search","rex","valid","splunk_doc"]
		},
		"splunk_rex_4": {
			"search":"index=idx | rex field=ccnumber mode=sed \"s/(\\d{4}-){3}/XXXX-XXXX-XXXX-/g\"",
			"exp_err":0,
			"tags":["search","rex","valid","splunk_doc"]
		},
		"splunk_rex_5": {
			"search":"sourcetype=linux_secure port \"failed password\" | rex \"\\s+(?<ports>port \\d+)\" | top src_ip ports showperc=0",
			"exp_err":0,
			"tags":["search","rex","valid","splunk_doc","top"]
		},
		"splunk_rtorder_1": {
			"search":"index=idx | rtorder discard=t buffer_span=5m",
			"exp_err":0,
			"tags":["search","rtorder","valid","splunk_doc"]
		},
		"splunk_savedsearch_1": {
			"search":"| savedsearch mysecurityquery",
			"exp_err":0,
			"tags":["savedsearch","valid","splunk_doc"]
		},
		"splunk_savedsearch_2": {
			"search":"| savedsearch mysearch replace_me=\"value\"",
			"exp_err":0,
			"tags":["savedsearch","valid","splunk_doc"]
		},
		"splunk_script_1": {
			"search":"index=idx | script myscript myarg1 myarg2 | sendemail to=david@splunk.com",
			"exp_err":0,
			"tags":["search","script","valid","splunk_doc","sendemail"]
		},
		"splunk_scrub_1": {
			"search":"index=idx | scrub",
			"exp_err":0,
			"tags":["search","scrub","valid","splunk_doc"]
		},
		"splunk_scrub_2": {
			"search":"index=idx | scrub private-terms=abc_private-terms",
			"exp_err":0,
			"tags":["search","scrub","valid","splunk_doc"]
		},
		"splunk_searchtxn_1": {
			"search":"| searchtxn email to=root from=\"David Smith\"",
			"exp_err":0,
			"tags":["searchtxn","valid","splunk_doc"]
		},
		"splunk_selfjoin_1": {
			"search":"index=idx | selfjoin id",
			"exp_err":0,
			"tags":["search","selfjoin","valid","splunk_doc"]
		},
		"splunk_selfjoin_2": {
			"search":"| makeresults count=5 | streamstats count as a | eval _time = _time + (60*a) | eval joiner=\"x\" | eval b = if(a%2==0,\"something\"+a,\"nada\"+a), c = if(a%2==1,\"somethingelse\"+a,null()) | selfjoin joiner",
			"exp_err":0,
			"tags":["makeresults","selfjoin","valid","splunk_doc","streamstats","eval"]
		},
		"splunk_sendemail_1": {
			"search":"index=idx | sendemail to=\"elvis@splunk.com\" sendresults=true",
			"exp_err":0,
			"tags":["search","sendemail","valid","splunk_doc"]
		},
		"splunk_sendemail_2": {
			"search":"index=idx | sendemail to=\"elvis@splunk.com,john@splunk.com\" format=raw subject=myresults server=mail.splunk.com sendresults=true",
			"exp_err":0,
			"tags":["search","sendemail","valid","splunk_doc"]
		},
		"splunk_sendemail_3": {
			"search":"index=_internal | head 5 | sendemail to=example@splunk.com server=mail.example.com subject=\"Here is an email from Splunk\" message=\"This is an example message\" sendresults=true inline=true format=raw sendpdf=true",
			"exp_err":0,
			"tags":["search","sendemail","valid","splunk_doc","head"]
		},
		"splunk_set_1": {
			"search":"| set diff [search 404 | fields url] [search 303 | fields url]",
			"exp_err":0,
			"tags":["set","valid","splunk_doc","subsearch"]
		},
		"splunk_set_2": {
			"search":"| set intersect [search 404 | fields url | fields - _*] [search 303 | fields url | fields - _*]",
			"exp_err":0,
			"tags":["set","valid","splunk_doc","subsearch"]
		},
		"splunk_setfields_1": {
			"search":"index=idx | setfields ip=\"10.10.10.10\", foo=\"foo bar\"",
			"exp_err":0,
			"tags":["search","setfields","valid","splunk_doc"]
		},
		"splunk_sichart_1": {
			"search":"index=idx | sichart avg(foo) by bar",
			"exp_err":0,
			"tags":["search","sichart","valid","splunk_doc"]
		},
		"splunk_sirare_1": {
			"search":"index=idx | sirare foo bar",
			"exp_err":0,
			"tags":["search","sirare","valid","splunk_doc"]
		},
		"splunk_sistats_1": {
			"search":"index=idx | sistats avg(*lay) BY date_hour",
			"exp_err":0,
			"tags":["search","sistats","valid","splunk_doc"]
		},
		"splunk_sitop_1": {
			"search":"index=idx | sitop foo bar",
			"exp_err":0,
			"tags":["search","sitop","valid","splunk_doc"]
		},
		"splunk_sitop_2": {
			"search":"eventtype=firewall | sitop src_ip",
			"exp_err":0,
			"tags":["search","sitop","valid","splunk_doc"]
		},
		"splunk_sitimechart_1": {
			"search":"index=idx | sitimechart avg(cpu) BY host | collect index=mysummary",
			"exp_err":0,
			"tags":["search","sitimechart","valid","splunk_doc","collect"]
		},
		"splunk_spath_1": {
			"search":"index=idx | spath output=myfield path=foo.bar.baz",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc"]
		},
		"splunk_spath_2": {
			"search":"index=idx | spath output=myfield server.name",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc"]
		},
		"splunk_spath_3": {
			"search":"index=idx | spath output=myfield path=foo{1}",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc"]
		},
		"splunk_spath_4": {
			"search":"index=idx | spath output=myfield path=foo.bar{}.baz",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc"]
		},
		"splunk_spath_5": {
			"search":"index=idx | spath output=dates path=purchases.book.title{@yearPublished} | table dates",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc","table"]
		},
		"splunk_spath_6": {
			"search":"index=idx | spath output=commit_author path=commits{}.author.name",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc"]
		},
		"splunk_spath_7": {
			"search":"index=idx | spath path=vendorProductSet.product.desc.locDesc{4}{@locale}",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc"]
		},
		"splunk_spath_8": {
			"search":"sourcetype=json | spath | rename widget.text.size AS size, widget.text.data AS data | eval x=mvzip(data,size)| mvexpand x | eval x = split(x,\",\") | eval data=mvindex(x,0) | eval size=mvindex(x,1) | table _time,data, size",
			"exp_err":0,
			"tags":["search","spath","valid","splunk_doc","rename","eval","mvexpand","table"]
		},
		"splunk_stats_1": {
			"search":"sourcetype=access* | stats avg(kbps) BY host",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc"]
		},
		"splunk_stats_2": {
			"search":"sourcetype=access_combined | top limit=100 referer_domain | stats sum(count) AS total",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc","top"]
		},
		"splunk_stats_3": {
			"search":"index=idx | stats avg(*lay) BY date_hour",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc"]
		},
		"splunk_stats_4": {
			"search":"index=idx | stats dc(host)",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc"]
		},
		"splunk_stats_5": {
			"search":"index=idx | stats avg(field) BY mvfield dedup_splitvals=true",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc"]
		},
		"splunk_stats_6": {
			"search":"sourcetype=access_* | stats count(eval(method=\"GET\")) AS GET, count(eval(method=\"POST\")) AS POST BY host",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc"]
		},
		"splunk_stats_7": {
			"search":"source=usgs place=*California* | stats count mean(mag), stdev(mag), var(mag) BY magType",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc"]
		},
		"splunk_stats_8": {
			"search":"sourcetype=access_* status=200 action=purchase | stats values(categoryId) AS Type, values(productName) AS \"Product Name\", sum(price) AS \"Revenue\" by productId | rename productId AS \"Product ID\" | eval Revenue=\"$ \".tostring(Revenue,\"commas\")",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc","eval"]
		},
		"splunk_stats_9": {
			"search":"sourcetype=\"cisco:esa\" mailfrom=* | eval accountname=split(mailfrom,\"@\"), from_domain=mvindex(accountname,-1) | stats count(eval(match(from_domain, \"[^\n\r\\s]+\\.com\"))) AS \".com\", count(eval(match(from_domain, \"[^\n\r\\s]+\\.net\"))) AS \".net\", count(eval(match(from_domain, \"[^\n\r\\s]+\\.org\"))) AS \".org\", count(eval(NOT match(from_domain, \"[^\n\r\\s]+\\.(com|net|org)\"))) AS \"other\"",
			"exp_err":0,
			"tags":["search","stats","valid","splunk_doc","eval"]
		},
		"splunk_strcat_1": {
			"search":"index=idx | strcat sourceIP \"/\" destIP comboIP",
			"exp_err":0,
			"tags":["search","strcat","valid","splunk_doc"]
		},
		"splunk_strcat_2": {
			"search":"host=\"mailserver\" | strcat sourceIP \"/\" destIP comboIP | chart count by comboIP",
			"exp_err":0,
			"tags":["search","strcat","valid","splunk_doc","chart"]
		},
		"splunk_strcat_3": {
			"search":"index=idx | strcat host \"::\" port address",
			"exp_err":0,
			"tags":["search","strcat","valid","splunk_doc"]
		},
		"splunk_streamstats_1": {
			"search":"| makeresults count=3 | streamstats count | eval test=if(count==2,\"yes\",\"no\") | streamstats count as testCount reset_after=\"(\"match(test,\"yes\")\")\"",
			"exp_err":0,
			"tags":["makeresults","streamstats","valid","splunk_doc","eval"]
		},
		"splunk_streamstats_2": {
			"search":"index=idx | streamstats avg(foo) window=5",
			"exp_err":0,
			"tags":["search","streamstats","valid","splunk_doc"]
		},
		"splunk_streamstats_3": {
			"search":"index=idx | streamstats avg(foo) by bar window=5 global=f",
			"exp_err":0,
			"tags":["search","streamstats","valid","splunk_doc"]
		},
		"splunk_streamstats_4": {
			"search":"index=idx | streamstats count current=f",
			"exp_err":0,
			"tags":["search","streamstats","valid","splunk_doc"]
		},
		"splunk_streamstats_5": {
			"search":"sourcetype=access_combined* | head 5 |sort _time | streamstats sum(bytes) AS ASimpleSumOfBytes BY clientip",
			"exp_err":0,
			"tags":["search","streamstats","valid","splunk_doc","head","sort"]
		},
		"splunk_streamstats_6": {
			"search":"eventtype=\"download\" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as \"Cumulative total\"",
			"exp_err":0,
			"tags":["search","streamstats","valid","splunk_doc","bin","stats"]
		},
		"splunk_streamstats_7": {
			"search":"index=idx | timechart span=1h sum(bytes) as SumOfBytes | streamstats global=f sum(*) as accu_total_*",
			"exp_err":0,
			"tags":["search","streamstats","valid","splunk_doc","timechart"]
		},
		"splunk_table_1": {
			"search":"index=usgs_* source=usgs place=*California | table time, place, mag, depth",
			"exp_err":0,
			"tags":["search","table","valid","splunk_doc"]
		},
		"splunk_table_2": {
			"search":"index=usgs_* source=usgs place=*California | rename lat as latitude lon as longitude | table time, place, lat*, lon*, mag",
			"exp_err":0,
			"tags":["search","table","valid","splunk_doc","rename"]
		},
		"splunk_table_3": {
			"search":"sourcetype=access_* | dedup clientip | eval network=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | table clientip, network",
			"exp_err":0,
			"tags":["search","table","valid","splunk_doc","dedup","eval"]
		},
		"splunk_tags_1": {
			"search":"sourcetype=access_* | stats count by host sourcetype | tags",
			"exp_err":0,
			"tags":["search","tags","valid","splunk_doc","stats"]
		},
		"splunk_tags_2": {
			"search":"index=idx | tags host eventtype",
			"exp_err":0,
			"tags":["search","tags","valid","splunk_doc"]
		},
		"splunk_tags_3": {
			"search":"index=idx | tags outputfield=test",
			"exp_err":0,
			"tags":["search","tags","valid","splunk_doc"]
		},
		"splunk_tags_4": {
			"search":"index=idx | tags outputfield=test inclname=t host sourcetype",
			"exp_err":0,
			"tags":["search","tags","valid","splunk_doc"]
		},
		"splunk_tail_1": {
			"search":"index=idx | tail 20",
			"exp_err":0,
			"tags":["search","tail","valid","splunk_doc"]
		},
		"splunk_timechart_1": {
			"search":"index=idx | timechart span=1m eval(avg(CPU) * avg(MEM)) BY host",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_2": {
			"search":"index=idx | timechart eval(round(avg(cpu_seconds),2)) BY processor",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_3": {
			"search":"index=idx | timechart span=1m avg(CPU) BY host",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_4": {
			"search":"index=idx | timechart avg(cpu_seconds) BY host | outlier action=tf",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc","outlier"]
		},
		"splunk_timechart_5": {
			"search":"index=idx | timechart span=5m avg(thruput) BY host",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_6": {
			"search":"sshd failed OR failure | timechart span=1m count(eventtype) BY source_ip usenull=f WHERE count>10",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_7": {
			"search":"index=idx | timechart _time span=12h aligntime=@d+5h",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_8": {
			"search":"index=idx | timechart avg(field) BY mvfield dedup_splitvals=true",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_9": {
			"search":"sourcetype=access_* action=purchase | timechart per_hour(price) by productName usenull=f useother=f",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_10": {
			"search":"sourcetype=access_* action=purchase | timechart span=1d count by categoryId usenull=f",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timechart_11": {
			"search":"source=all_month.csv place=*alaska* mag>=3.5 | timechart span=w@w1 count BY mag",
			"exp_err":0,
			"tags":["search","timechart","valid","splunk_doc"]
		},
		"splunk_timewarp_1": {
			"search":"index=idx | timechart count span=1d | timewrap 1week",
			"exp_err":0,
			"tags":["search","timewarp","valid","splunk_doc","timechart"]
		},
		"splunk_timewarp_2": {
			"search":"index=idx | timechart count span=1h | timewrap  d series=short | addtotals s* | eval 7dayavg=Total/7.0 | table _time, _span, s0, s1, 7dayavg | rename s0 as now, s1 as yesterday",
			"exp_err":0,
			"tags":["search","timewarp","valid","splunk_doc","timechart","addtotals","eval","table","rename"]
		},
		"splunk_timewarp_3": {
			"search":"index=idx | timechart count span=1h | timewrap w | where strftime(_time, \"%A\") == \"Wednesday\"",
			"exp_err":0,
			"tags":["search","timewarp","valid","splunk_doc","timechart","where"]
		},
		"splunk_top_1": {
			"search":"sourcetype=access_* | top limit=20 referer",
			"exp_err":0,
			"tags":["search","top","valid","splunk_doc","top"]
		},
		"splunk_top_2": {
			"search":"sourcetype=access_* | top action by referer_domain",
			"exp_err":0,
			"tags":["search","top","valid","splunk_doc","top"]
		},
		"splunk_top_3": {
			"search":"sourcetype=access_* status=200 action=purchase | top 1 productName by categoryId showperc=f countfield=total",
			"exp_err":0,
			"tags":["search","top","valid","splunk_doc","top"]
		},
		"splunk_transpose_1": {
			"search":"index=idx | chart count BY host error_code | transpose",
			"exp_err":0,
			"tags":["search","transpose","valid","splunk_doc","chart"]
		},
		"splunk_transpose_2": {
			"search":"index=_internal | stats count by sourcetype | sort -count | transpose 3",
			"exp_err":0,
			"tags":["search","transpose","valid","splunk_doc","stats","sort"]
		},
		"splunk_trendline_1": {
			"search":"index=idx | trendline sma5(foo) AS smoothed_foo ema10(bar)",
			"exp_err":0,
			"tags":["search","trendline","valid","splunk_doc"]
		},
		"splunk_trendline_2": {
			"search":"index=\"bar\" | stats count BY date_month | trendline sma2(count) AS trend | fields * trend",
			"exp_err":0,
			"tags":["search","trendline","valid","splunk_doc","stats","fields"]
		},
		"splunk_tscollect_1": {
			"search":"index=idx | tscollect namespace=foo",
			"exp_err":0,
			"tags":["search","tscollect","valid","splunk_doc"]
		},
		"splunk_tscollect_2": {
			"search":"index=main | fields foo | tscollect",
			"exp_err":0,
			"tags":["search","tscollect","valid","splunk_doc","fields"]
		},
		"splunk_tstats_1": {
			"search":"| tstats count FROM mydata",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_tstats_2": {
			"search":"| tstats avg(foo) FROM mydata WHERE bar=value2 baz>5",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_tstats_3": {
			"search":"| tstats count WHERE host=x BY source",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_tstats_4": {
			"search":"| tstats prestats=t count BY _time span=1d | timechart span=1d count",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc","timechart"]
		},
		"splunk_tstats_5": {
			"search":"| tstats prestats=t median(foo) FROM mydata | tstats prestats=t append=t median(bar) FROM otherdata | stats median(foo) median(bar)",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc","stats"]
		},
		"splunk_tstats_6": {
			"search":"| tstats summariesonly=t min(_time) AS min, max(_time) AS max FROM datamodel=mydm | eval prettymin=strftime(min, \"%c\") | eval prettymax=strftime(max, \"%c\")",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_tstats_7": {
			"search":"| tstats summariesonly=t prestats=t count FROM datamodel=mydm BY _time span=1h | timechart span=1h count",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_tstats_8": {
			"search":"| tstats values(source) FROM datamodel=internal_server",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_tstats_9": {
			"search":"| tstats values(source) FROM datamodel=internal_server where nodename=server.scheduler.alerts",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_tstats_10": {
			"search":"| tstats count avg(PREFIX(kbps=)) where index=_internal by source PREFIX(group=)",
			"exp_err":0,
			"tags":["tstats","valid","splunk_doc"]
		},
		"splunk_typeahead_1": {
			"search":"| typeahead prefix=source count=10 index=_internal",
			"exp_err":0,
			"tags":["typeahead","valid","splunk_doc"]
		},
		"splunk_typelearner_1": {
			"search":"index=idx | typelearner",
			"exp_err":0,
			"tags":["search","typelearner","valid","splunk_doc"]
		},
		"splunk_typer_1": {
			"search":"index=idx | typer",
			"exp_err":0,
			"tags":["search","typer","valid","splunk_doc"]
		},
		"splunk_union_1": {
			"search":"| union [search index=a | eval type = \"foo\"] [search index=b | eval mytype = \"bar\"]",
			"exp_err":0,
			"tags":["union","valid","splunk_doc"]
		},
		"splunk_union_2": {
			"search":"index=idx | chart count by category1 | union [search error | chart count by category2]",
			"exp_err":0,
			"tags":["search","union","valid","splunk_doc","chart"]
		},
		"splunk_union_3": {
			"search":"index=idx | union datamodel:\"internal_server.splunkdaccess\" [search index=a]",
			"exp_err":0,
			"tags":["search","union","valid","splunk_doc"]
		},
		"splunk_union_4": {
			"search":"index=idx | chart count by category1 | union maxout=20000 maxtime=120 timeout=600 [search error | chart count by category2]",
			"exp_err":0,
			"tags":["search","union","valid","splunk_doc","chart"]
		},
		"splunk_uniq_1": {
			"search":"index=idx | uniq",
			"exp_err":0,
			"tags":["search","uniq","valid","splunk_doc"]
		},
		"splunk_untable_1": {
			"search":"sourcetype=access_* status=200 action=purchase | top categoryId | untable categoryId calculation value",
			"exp_err":0,
			"tags":["search","untable","valid","splunk_doc","top"]
		},
		"splunk_untable_2": {
			"search":"index=idx | table _time EventCode Message | streamstats count as recno | untable recno FieldName FieldValue",
			"exp_err":0,
			"tags":["search","untable","valid","splunk_doc","table","streamstats"]
		},
		"splunk_untable_3": {
			"search":"index=idx | table _time EventCode Message | streamstats count as recno | rename _time as time | untable recno FieldName FieldValue | xyseries recno FieldName FieldValue | rename time as _time",
			"exp_err":0,
			"tags":["search","untable","valid","splunk_doc","table","streamstats","rename","xyseries"]
		},
		"splunk_walklex_1": {
			"search":"| walklex index=_internal | stats sum(count) BY term",
			"exp_err":0,
			"tags":["walklex","valid","splunk_doc","stats"]
		},
		"splunk_walklex_2": {
			"search":"| walklex prefix=foo index=_internal index=_audit",
			"exp_err":0,
			"tags":["walklex","valid","splunk_doc","stats"]
		},
		"splunk_walklex_3": {
			"search":"| walklex pattern=*bar type=fieldvalue index=_internal",
			"exp_err":0,
			"tags":["walklex","valid","splunk_doc","stats"]
		},
		"splunk_walklex_4": {
			"search":"| walklex type=field index=_audit",
			"exp_err":0,
			"tags":["walklex","valid","splunk_doc","stats"]
		},
		"splunk_where_1": {
			"search":"indx=idx | where like(ipaddress, \"198.%\")",
			"exp_err":0,
			"tags":["search","where","valid","splunk_doc"]
		},
		"splunk_where_2": {
			"search":"host=\"CheckPoint\" | where like(src, \"10.9.165.%\") OR cidrmatch(\"10.9.165.0/25\", dst)",
			"exp_err":0,
			"tags":["search","where","valid","splunk_doc"]
		},
		"splunk_where_3": {
			"search":"sourcetype=physicsjobs | where distance/time > 100",
			"exp_err":0,
			"tags":["search","where","valid","splunk_doc"]
		},
		"splunk_x11_1": {
			"search":"index=download | timechart span=1d count(file) as count | x11 mult15(count)",
			"exp_err":0,
			"tags":["search","x11","valid","splunk_doc","timechart"]
		},
		"splunk_x11_2": {
			"search":"index=download | timechart span=1d count(file) as count | x11 add20(count)",
			"exp_err":0,
			"tags":["search","x11","valid","splunk_doc","timechart"]
		},
		"splunk_xmlkv_1": {
			"search":"index=idx | xmlkv",
			"exp_err":0,
			"tags":["search","xmlkv","valid","splunk_doc"]
		},
		"splunk_xmlkv_2": {
			"search":"index=idx | xmlkv maxinputs=10000",
			"exp_err":0,
			"tags":["search","xmlkv","valid","splunk_doc"]
		},
		"splunk_xmlunescape_1": {
			"search":"index=idx | xmlunescape",
			"exp_err":0,
			"tags":["search","xmlunescape","valid","splunk_doc"]
		},
		"splunk_xpath_2": {
			"search":"sourcetype=\"xml\" | xpath outfield=instrument_id \"//DataSet[sname='BARC']/instrument_id\"",
			"exp_err":0,
			"tags":["search","xpath","valid","splunk_doc"]
		},
		"splunk_xpath_1": {
			"search":"sourcetype=\"xml\" | xpath outfield=name \"//bar/@nickname\"",
			"exp_err":0,
			"tags":["search","xpath","valid","splunk_doc"]
		},
		"splunk_xpath_3": {
			"search":"| makeresults | eval xml=\"<DataSet xmlns=\\\"\\\"><identity_id>1037669</identity_id><instrument_id>219383KM1</instrument_id><transaction_code>SEL</transaction_code><sname>TARC</sname><currency_code>USA</currency_code></DataSet>\" | xpath outfield=identity_id \"//DataSet/identity_id\" field=xml",
			"exp_err":0,
			"tags":["makeresults","xpath","valid","splunk_doc","eval"]
		},
		"splunk_xyseries_1": {
			"search":"sourcetype=access_* status=200 action=purchase | top categoryId | xyseries categoryId count percent",
			"exp_err":0,
			"tags":["search","xyseries","valid","splunk_doc"]
		},
		"splunk_xyseries_2": {
			"search":"sourcetype=access_combined_wcookie | stats count(host) count(productId) by clientip, referer_domain | xyseries clientip referer_domain count(host), count(productId)",
			"exp_err":0,
			"tags":["search","xyseries","valid","splunk_doc","stats"]
		},
		"splunk_xyseries_3": {
			"search":"sourcetype=access_combined_wcookie | stats count(host) count(productId) by clientip, referer_domain | xyseries clientip referer_domain count(host), count(productId) sep=\"-\"",
			"exp_err":0,
			"tags":["search","xyseries","valid","splunk_doc","stats"]
		},
		"splunk_xyseries_4": {
			"search":"sourcetype=access_combined_wcookie | stats count(host) count(productId) by clientip, referer_domain | xyseries clientip referer_domain count(host), count(productId) sep=\"-\" format=\"$AGG$ + $VAL$ TEST\"",
			"exp_err":0,
			"tags":["search","xyseries","valid","splunk_doc","stats"]
		}

	}
}