Skip to main content

Misc

Comparisons To SQL and Splunk Processing Language

Language Design

  • SQL/SPL are all "script". No if/else. Difficult to learn for programers.
  • FPL: javascript es6 grammar. Real programming language with if/else statement, for loop and exception support.

Data Source

  • SQL: relational database
  • SPL: data lake
  • FPL: data lake, any document based database, key-value store, time series database (TSDB). Support both json document store and metric data stream.
  • FPL: support data source based on cloud API, such as cloudwatch get_metric api, AWS management "describe" and "list" APIs.

Throughput and Efficiency

  • FPL: Native execution in Golang. Built-in support for parallel multi-account, multi-region data queries.

Report / Alert

  • FPL: Fully automated anomaly detection. Support table/chart/alert rendering.

Data streaming support

  • SQL/SPL: n/a
  • FPL: support streaming mode, parse/normalize streaming data

Code Comparison

SELECT

// SQL
SELECT col1, col2 from table1 where col3="hello"

// FPL
Load("remoteAsset", ({col1, col2, col3}) => {
if col3=="hello" {
return {col1, col2}
}
return null
})

Aggregate / GROUPBY

// SQL
SELECT col1, sum(col2) from table
WHERE col3="hello"
GROUP BY col4

// FPL
Load("remoteAsset", ({col1, col2, col3, col4}) => {
if col3=="hello" {
return { aggregate: {groupBy:{col4}, columns:{sum:{col2}}}}
}
return null
})

JOIN

// SQL
SELECT * from table1
INNER JOIN tabl2
ON table1.col1=table2.col2

// FPL
table1.Join(table2, ({ID2:ID1}, {col21, col22 ...}) => "inner" )

Sort

// SQL
SELECT * from table1
ORDER BY col1 desc
Limit 10
// FPL
table1.Sort(10, "-col1")
// OR method chaining
Load("remoteAsset", ( { col1, col2, col3, col4}) => {
if col3=="hello" {
return { aggregate: {groupBy:{col4}, columns:{sum:{Total:col2}}}}
}
return null
}).Sort(10, "-Total")

Fluency Login

https://app.storylane.io/share/ipyaxbuoquet

Formatting (2rem)

H2 - asdfa sdf (1.75rem)

H3 - asdfa sdf (1.5rem)

H4 - asdfa sdf (1.25rem)

H1 - asdfa sdf (2rem)

H2 - asdfa sdf

H4 - asdfa sdf

H5 - asdfa sdf (1.1rem)
H6 - asdfa sdf

Text asdfa sdf

H3 - asdfa sdf