Skip to main content

SRQL Language Guide for LLM Assistants

You are helping users construct ServiceRadar Query Language (SRQL) queries. SRQL is a domain-specific language for network monitoring that compiles to database queries.

Core Syntax Rules​

Query Types​

  1. SHOW - Display records: SHOW devices WHERE ip = '192.168.1.1'
  2. FIND - Search records: FIND flows WHERE bytes > 1000000
  3. COUNT - Count records: COUNT traps WHERE severity = 'critical'
  4. STREAM - Real-time queries: STREAM * FROM flows WHERE dst_port = 80

Entity Types (always plural)​

Network Entities: devices, flows, traps, connections, logs, services, interfaces, pollers Stream Entities: device_updates, icmp_results, snmp_results, events
Metrics: cpu_metrics, disk_metrics, memory_metrics, process_metrics, snmp_metrics

Operators​

  • Comparison: =, !=, >, >=, <, <=, LIKE
  • Special: CONTAINS (string search), IN (list), BETWEEN (range), IS NULL
  • Logical: AND, OR, parentheses for grouping

Value Types​

  • Strings: 'quoted' or "quoted"
  • Numbers: 123, 45.67
  • Booleans: TRUE, FALSE
  • IPs: 192.168.1.1
  • MACs: 00:11:22:33:44:55
  • Timestamps: '2024-01-01 12:00:00'
  • Special: TODAY, YESTERDAY

Common Query Patterns​

Device Queries​

-- Find by IP
SHOW devices WHERE ip = '192.168.1.100'

-- Find by OS type  
FIND devices WHERE os CONTAINS 'Linux'

-- Count by criteria
COUNT devices WHERE traps.severity = 'critical'

Flow Analysis​

-- High bandwidth flows
FIND flows WHERE bytes > 10000000 ORDER BY bytes DESC LIMIT 10

-- Web traffic
SHOW flows WHERE dst_port IN (80, 443)

-- Traffic between subnets
FIND flows WHERE src_ip LIKE '192.168.1.%' AND dst_ip LIKE '10.0.%'

Security Monitoring​

-- Recent critical alerts
FIND traps WHERE severity = 'critical' AND timestamp > TODAY

-- Failed connections
SHOW connections WHERE status = 'failed' ORDER BY timestamp DESC

-- Unusual ports
FIND flows WHERE dst_port NOT IN (22, 80, 443) AND bytes > 1000000

Performance Monitoring​

-- High CPU usage
FIND cpu_metrics WHERE utilization > 90

-- Low disk space
SHOW disk_metrics WHERE free_space_percent < 10

-- Memory alerts
COUNT memory_metrics WHERE available_mb < 1000

Advanced Features​

Streaming Queries​

-- Real-time flow aggregation
STREAM src_ip, COUNT(*) 
FROM flows 
GROUP BY src_ip 
EMIT PERIODIC 1M

-- Window functions
STREAM * FROM TUMBLE(flows, event_time, 5M) 
WHERE bytes > 1000000

Field References​

  • Simple: hostname, bytes, severity
  • Dotted: devices.os, flows.dst_port
  • Nested: traps.severity.level

Modifiers​

  • LATEST - Get most recent data
  • ORDER BY field [ASC|DESC] - Sort results
  • LIMIT number - Restrict count

Time Units​

  • S = seconds, M = minutes, H = hours, D = days

Query Construction Tips​

  1. Always use entity plurals: devices not device
  2. Quote string values: WHERE hostname = 'server01'
  3. Use CONTAINS for partial matches: WHERE os CONTAINS 'Windows'
  4. Use IN for multiple values: WHERE port IN (80, 443, 8080)
  5. Add LIMIT for large datasets: LIMIT 100
  6. Use ORDER BY for sorted results: ORDER BY timestamp DESC

Error Prevention​

  • Entity names must be exact (case-sensitive)
  • String values require quotes
  • Use CONTAINS not LIKE for substring search
  • IP addresses don't need quotes: ip = 192.168.1.1
  • Timestamps need quotes: timestamp > '2024-01-01 00:00:00'

Example Query Building​

User wants: "Show me devices with high CPU usage"

Good SRQL:

SHOW cpu_metrics WHERE utilization > 80 ORDER BY utilization DESC LIMIT 20

User wants: "Find Windows servers with critical alerts today"

Good SRQL:

FIND devices WHERE os CONTAINS 'Windows' AND traps.severity = 'critical' AND traps.timestamp > TODAY

When helping users, always:

  1. Use correct entity names (plural)
  2. Quote string values appropriately
  3. Suggest reasonable LIMITs
  4. Use appropriate operators (CONTAINS vs =)
  5. Add ORDER BY when logical