Parseable

SQL Queries

Run SQL queries against Parseable datasets using pb sql.


pb sql runs SQL queries against Parseable datasets. Use it for quick one-off searches, JSON output in scripts, saved queries, or the interactive table TUI.

Basic usage

pb sql run "SELECT * FROM backend" --from=10m --to=now

--from and --to define the time window to query. The dataset name is the SQL FROM target.

Time range syntax

FormatExampleMeaning
Relative10m, 2h, 7dLast N minutes / hours / days
Absolute2024-01-15T00:00:00ZExact RFC3339 timestamp
KeywordnowCurrent time

Last 30 minutes:

pb sql run "SELECT * FROM logs LIMIT 100" --from=30m

Specific time window:

pb sql run "SELECT count(*) FROM logs" --from=2024-01-01T00:00:00Z --to=2024-01-02T00:00:00Z

Default (last 1 minute if --from is not specified):

pb sql run "SELECT * FROM logs"

Output modes

Without -i, pb sql run prints the query response directly to the terminal. Use --output json when you need JSON for scripts. Use -i when you want the interactive table UI.

pb sql run "SELECT * FROM logs LIMIT 50" --from=1h
pb sql run "SELECT * FROM logs LIMIT 50" --from=1h --output json
pb sql run "SELECT * FROM logs LIMIT 50" --from=1h -i

Save and reuse queries

Save a query for later with --save-as:

pb sql run "SELECT level, count(*) FROM logs GROUP BY level" --from=1h --save-as=error-summary

Save without running the query:

pb sql save "SELECT * FROM frontend WHERE status >= 500" --name=frontend-errors --from=1h --to=now

List and manage saved queries:

pb sql list
pb sql ls
pb sql list --output json

Without --output json, the list command opens an interactive menu for selecting saved queries.

Interactive TUI mode

Add -i to open the full-screen interactive query interface:

pb sql run -i
pb sql run "SELECT * FROM backend WHERE status = 500" --from=1h -i

The TUI includes panels for query editing, time range, dataset selection, columns, and results. Navigate between panels with Tab / Shift+Tab.

KeyAction
Tab / Shift+TabSwitch between panels
Ctrl+RRun query
/ Scroll rows
Shift+↑ / Shift+↓Page up / down
Left / RightScroll columns
/Filter table rows
EscClear filter
Ctrl+BPrevious page of results

Field names containing dots (OTel convention, e.g. service.name) or hyphens are automatically quoted in queries. You don't need to add quotes manually.

Command reference

CommandDescription
pb sql run [query]Run a SQL query and print plain terminal output
pb sql run -iOpen the interactive SQL table view
pb sql save [query]Save a SQL query without running it
pb sql listList saved queries
pb sql lsAlias for pb sql list

Was this page helpful?

On this page