---
title: "SPQL Command Line Utility"
slug: "command-line-utility"
description: "SPQL features a simple command line client that allows users to write plain SPQL queries. Queries can either be executed directly or run to only display the JSON encoded query to be used in conjunction with curl or Postman."
tags: ["spql"]
updated: 2026-01-07T15:43:47Z
published: 2026-01-07T15:43:47Z
canonical: "help.silentpush.com/command-line-utility"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SPQL Command Line Utility

The Silent Push Query Language (SPQL) command-line client (`spql_cli.py`) allows users to run SPQL queries or generate JSON-encoded queries for tools like `curl` or Postman. Refer to the [SPQL syntax rules](/v1/docs/syntax) and [SPQL query examples](/v1/docs/query-examples) for constructing queries.

## Syntax

```json
 spql_cli.py [OPTION]
```

## Options

| Option | Description |
| --- | --- |
| `-q`, `--query 'TEXT'` | (Required) SPQL query as a string. |
| `-f`, `--fields TEXT` | Comma-separated field names in square brackets (e.g., `[domain,ip]`). Can be set as `SPQL_FIELDS` environment variable. |
| `-s`, `--sort TEXT` | Comma-separated sort fields/orders in square brackets (e.g., `[domain/asc,scan_date/desc]`). Can be set as `SPQL_SORT`. |
| `--api-key TEXT` | (Required) Silent Push API key. Can be set as `SPQL_API_KEY` environment variable. |
| `--limit INTEGER` | Maximum results to return. |
| `--skip INTEGER` | Number of results to skip. |
| `--with_metadata INTEGER <0 1>` | Include metadata with results. |
| `-e`, `--echo-query` | Display JSON-encoded query without executing it. |
| `-h`, `--help` | Show this message and exit |

## Environment Variables

- **API key**: `export SPQL_API_KEY=<api_key>`
- **Fixed field**s: `export SPQL_FIELDS=[domain,hostname,ip,url,htmltitle]`
- **Sort order**: `export SPQL_SORT=[domain/asc,scan_date/desc]`

### Example

Search for servers with a specific content-type (excluding Apache/nginx), that have `opendirectory` and `cpanel` in their SSL names, were scanned in the last 30 days, and are filtered by regex and TLD.

```plaintext
export SPQL_SORT=[domain/asc,scan_date/desc]
```

> **Note**: Use `—echo-query` to generate JSON for SPQL API Functionality. See [SPQL data sources](/v1/docs/data-sources) for targeting specific repositories.

A DNS request (resource record name, rrname) used to retrieve information about a domain, IP, or other network entity for threat analysis.