News for hackers. Stuff that matters.

A comment on Elasticsearch SQL. Parent comment

Re:Elasticsearch SQL by munk-a on Monday October 24, 2022 @04:21PM (#33322138)
Nothing could quite match my disappointment when I realized that Splunk (a large scale logging storage and retrieval product) decided to create a Splunk Query Language and eschew SQL... except maybe when I realized that they had no equivalent of `val IN(1,2,3...)` instead requiring `val = 1 OR val = 2 OR val = 3 ...`

I have taught several non-techy business analyst type people how to write SQL during my years of employment - it really isn't that hard when most of the time it's just "SELECT what you want FROM where you want it" and teaching more complex concepts when and if they come up.

[ Parent | on HN ]
Re:Elasticsearch SQL by deeebug on Monday October 24, 2022 @04:46PM (#33322487)
Unsure if it was added recently, but Splunk Query Language does have VAL IN (1,2,3) now -> https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchRef...
[ Parent | on HN ]
Re:Elasticsearch SQL by Philip-J-Fry on Monday October 24, 2022 @05:22PM (#33322838)
Splunk 7 added that from what I can find. 5 years old at least.
[ Parent | on HN ]
Re:Elasticsearch SQL by munk-a on Monday October 24, 2022 @05:27PM (#33322874)
I've been using it for quite a while.
[ Parent | on HN ]
Re:Elasticsearch SQL by matthewaveryusa on Monday October 24, 2022 @05:10PM (#33322709)
And when those more complex concepts do come up and are too difficult to teach (or you want to lower the barrier of entry), you can always create a view that reduces the complexity back down to a select from.
[ Parent | on HN ]