Misc
Comparisons To SQL and Splunk Processing Language
Language Design
- SQL/SPL are all "script". No if/else. Difficult to learn for programers.
- FPL: javascript es6 grammar. Real programming language with if/else statement, for loop and exception support.
Data Source
- SQL: relational database
- SPL: data lake
- FPL: data lake, any document based database, key-value store, time series database (TSDB). Support both json document store and metric data stream.
- FPL: support data source based on cloud API, such as cloudwatch get_metric api, AWS management "describe" and "list" APIs.
Throughput and Efficiency
- FPL: Native execution in Golang. Built-in support for parallel multi-account, multi-region data queries.
Report / Alert
- FPL: Fully automated anomaly detection. Support table/chart/alert rendering.
Data streaming support
- SQL/SPL: n/a
- FPL: support streaming mode, parse/normalize streaming data
Code Comparison
SELECT
// SQL
SELECT col1, col2 from table1 where col3="hello"
// FPL
Load("remoteAsset", ({col1, col2, col3}) => {
if col3=="hello" {
return {col1, col2}
}
return null
})
Aggregate / GROUPBY
// SQL
SELECT col1, sum(col2) from table
WHERE col3="hello"
GROUP BY col4
// FPL
Load("remoteAsset", ({col1, col2, col3, col4}) => {
if col3=="hello" {
return { aggregate: {groupBy:{col4}, columns:{sum:{col2}}}}
}
return null
})
JOIN
// SQL
SELECT * from table1
INNER JOIN tabl2
ON table1.col1=table2.col2
// FPL
table1.Join(table2, ({ID2:ID1}, {col21, col22 ...}) => "inner" )
Sort
// SQL
SELECT * from table1
ORDER BY col1 desc
Limit 10
// FPL
table1.Sort(10, "-col1")
// OR method chaining
Load("remoteAsset", ( { col1, col2, col3, col4}) => {
if col3=="hello" {
return { aggregate: {groupBy:{col4}, columns:{sum:{Total:col2}}}}
}
return null
}).Sort(10, "-Total")
Fluency Login
https://app.storylane.io/share/ipyaxbuoquet
Formatting (2rem)
H2 - asdfa sdf (1.75rem)
H3 - asdfa sdf (1.5rem)
H4 - asdfa sdf (1.25rem)
H1 - asdfa sdf (2rem)
H2 - asdfa sdf
H4 - asdfa sdf
H5 - asdfa sdf (1.1rem)
H6 - asdfa sdf
Text asdfa sdf