### Setting the source
`_sourceName=*service*`

### JSON parsing
`... | json auto | json auto field=message`

### JSON + where
`... | WHERE field_name = <value>`

### Cast Field to Number
`... | number(duration)`

### Math Operations
`... | round(duration / 1000) as duration_secs`

### Count By Field(s)
`... | count by field1, field2`