LogEasy SPL is similar to Splunk SPL. The differences are as follows:
1. When filtering fields, ":" is used between fields and values in the logeasy SPL, not "=". so you can write SPL like "appname:waf (proto :http OR proto:tcp)"
2. in LogEasy SPL, you need to add a "()" suffix after the function name, such as "|stats count()", and you can use 'as' to make an alias after the function, such as "|stats count() as cnt", then you can use the alias later, such as "stats count() as cnt by url | sort -cnt", you can use limit to limit the number of returns, such as "stats count() as cnt by url | sort -cnt|limit 10"
4. When filtering different log sources, logeasy to use appname instead of sourcetype. if you want to filter WAF logs, you can use "appname:waf" to indicate. Use hostname instead of host, and timestamp instead of _time.
5. When using `where` to express "and" logic, use "&&", when expressing "OR" logic, use "||", and when expressing "=" logic, use "=="
6. To extract content with regular expressions, you can use the `parse` command, such as `|parse "(?<field name>regular expression)"`
7. Use raw_message instead of _raw to represent the original log,  filter the http or tcp keyword in the original text, the expression is `http OR tcp`,no need to write `raw_message:http`
8. When searching for a certain range, the expression is `starttime="-1d/d" endtime="now" appname:waf`
Please use the above fields to write 10 logs according to the above description and the provided LogEasy SPL syntax sample to analyzes SQL inj There should be exactly 6 paragraphs separated by the markdown divider: ***.
user