F5 BIG-IP Estate — example report

F5 QUERY DSL — GRAMMAR

A query is a pipeline of stages joined by ``|``.  Each stage transforms
the current value (``.``) into one or more new values.  Pipelines may
be chained with ``;`` to evaluate multiple statements against the same
root.

  program       := pipeline (';' pipeline)*
  pipeline      := comma_expr ('|' comma_expr)*
  comma_expr    := pipe_stage (',' pipe_stage)*
  pipe_stage    := or_expr (ASSIGN_OP pipe_stage)?
  ASSIGN_OP     := '=' | '|=' | '+=' | '-='
  or_expr       := and_expr ('or' and_expr)*
  and_expr      := not_expr ('and' not_expr)*
  not_expr      := 'not' not_expr | cmp_expr
  cmp_expr      := add_expr (('==' | '!=' | '<' | '<=' | '>' | '>=') add_expr)?
  add_expr      := mul_expr (('+' | '-') mul_expr)*
  mul_expr      := unary    (('*' | '/') unary)*
  unary         := '-' unary | postfix
  postfix       := primary path_tail
  primary       := literal | call | path | variable | list_literal
                 | object_literal | if_expr | '(' pipeline ')'
  if_expr       := 'if' pipeline 'then' pipeline
                   ('elif' pipeline 'then' pipeline)*
                   ('else' pipeline)? 'end'
  variable      := '$' IDENT          /* root container of a named
                                         source loaded alongside this
                                         query (`f5 query` accepts
                                         several configs with
                                         filename-stem default names
                                         and an explicit --name N=PATH
                                         override).  Postfix path
                                         steps land afterwards, so
                                         `$gtm.gtm.wideip[]` reads from
                                         the source bound under
                                         `$gtm`.                       */
  object_literal:= '{' (entry (',' entry)*)? '}'
                                       /* jq-style object constructor:
                                          { name, destination: .dest }
                                          builds a dict per input.
                                          Stream values broadcast
                                          element-wise so one stream
                                          field becomes one row per
                                          item.                        */
  entry         := IDENT (':' pipe_stage)?
                 | STRING ':' pipe_stage
                                       /* Bareword shorthand: { name }
                                          desugars to { name: .name }.
                                          Wrap pipe/comma values in
                                          parens: {x: (.a | .b)}.     */
  pipe_stage    := or_expr (ASSIGN_OP pipe_stage)?
                 | or_expr 'as' '$' IDENT '|' pipeline
                                       /* let-binding: bind each
                                          value from `or_expr` to
                                          $IDENT and evaluate the
                                          downstream pipeline with
                                          that binding in scope.
                                          Right-associative so
                                          `.a[] as $x | .b | $x.c +
                                          ...` keeps $x bound across
                                          subsequent pipe stages.     */
  list_literal  := '[' pipeline? ']'        /* jq's array constructor */
  path          := '.'
                 | '.' field path_tail
                 | '.' '[' subscript ']' path_tail
  path_tail     := ('.' field '?'? | '[' subscript ']' '?'?)*
  field         := IDENT | STRING
  subscript     := /* empty -> stream */
                 | NUMBER
                 | STRING                /* exact subscript by string  */
                                         /* STRING starting with "~"
                                            inside [ ] is the regex
                                            subscript form            */
                 | pipeline              /* dynamic subscript          */
  call          := IDENT ('(' (pipe_stage (',' pipe_stage)*)? ')')?
                                         /* parens optional for 1-arg
                                            builtins — bare ``length``
                                            is equivalent to
                                            ``length(.)``               */
  literal       := NUMBER | STRING | 'true' | 'false' | 'null'

Pipelines iterate **streams**, not plain lists.  ``[]`` produces a
stream and stream-returning builtins do too; ``|`` then runs the next
stage once per item.  Plain lists (e.g. the value of ``.rules``) pass
through ``|`` whole — to fold a stream into a list for aggregators
like ``sort`` / ``unique``, wrap it: ``[.ltm.virtual[].name] | sort``.

Comma concatenates streams, matching jq's array-constructor idiom:
``[1, 2, .ltm.virtual[].name]`` evaluates each comma part against the
same input and collects the flattened stream.  Commas inside function
arguments and object entries remain structural separators; wrap a comma
stream in parentheses when it is a single argument or field value.

Assignment is a *trailing operator* on a pipe-stage, not a top-level
statement.  That makes ``.ltm.virtual[] | .destination |= ip(...)``
parse as ``.ltm.virtual[] | (.destination |= ip(...))`` — for each
streamed VS, set its destination to ``ip(...)`` of the current value.

PATH ACCESS

  .                       The current value (identity).
  .ltm.virtual            Field access — chained.
  .ltm.virtual.web_vs     TMSH partition shorthand: bare names resolve to
                          ``/Common/web_vs`` when unambiguous in the
                          target container.  Use the subscript form
                          ``.ltm.virtual["/Common/web_vs"]`` (see below)
                          for an explicit full-path lookup.
  .ltm.virtual["/Common/web_vs"]
                          Exact subscript by full-path.
  .ltm.virtual["~/vs_prod_"]
                          Regex subscript — matches every key whose
                          full-path (including the partition prefix)
                          contains the pattern.  Use the explicit
                          partition prefix in the pattern when you
                          want to anchor the match
                          (``"~^/Common/vs_prod_"``).
  .ltm.virtual[]          Stream every value in the container.
  .ltm.virtual[].pool     A path-ref to the default pool of each VS.
                          PathRefs act as strings AND as the referenced
                          object: ``.ltm.virtual[].pool.members[]`` walks
                          VS -> pool -> member transparently.

MODULES

  .ltm.<kind>             Local Traffic Manager kinds: ``virtual``,
                          ``pool``, ``node``, ``rule``, ``profile``,
                          ``monitor``, ``persistence``, ``snatpool``,
                          ``policy``, ``data-group``.  Each
                          ``ltm policy`` exposes ``.rules[]`` with
                          nested ``.conditions[]`` and
                          ``.actions[]`` sub-objects — chained
                          access like ``.ltm.policy[].rules[]
                          .actions[].pool`` walks into the target
                          pool via a PathRef.
  .net.<kind>             Network module: ``route``, ``vlan``,
                          ``self``, ``route-domain``, ``port-list``,
                          ``interface``, ``dns-resolver``,
                          ``tunnels-tunnel``, ``stp``.
                          PathRefs from ``net self.vlan`` and
                          ``net route-domain.vlans[]`` auto-deref
                          into the target ``net vlan`` so chained
                          access ``.net.self[].vlan.tag`` Just Works.

  .sys.<kind>             System module: ``dns``, ``ntp``, ``snmp``,
                          ``global-settings`` (singletons — one entry
                          each, streamed via ``.sys.dns[]``);
                          ``provision``, ``folder``, ``file-ssl-cert``,
                          ``file-ssl-key``, ``management-route``.
  .security.<kind>        Security module:
                          ``firewall-port-list``,
                          ``firewall-rule-list``,
                          ``firewall-config-entity-id``,
                          ``ip-intelligence-policy``,
                          ``protocol-inspection-compliance-map``,
                          ``protocol-inspection-compliance-objects``,
                          ``device-id-attribute``.
  .apm.<kind>             Access Policy Manager: ``access-policy``,
                          ``policy-item``, ``policy-agent``,
                          ``customization-source``,
                          ``oauth-db-instance``,
                          ``ssh-security-config``,
                          ``default-report`` (singleton).
                          PathRefs from ``access-policy.items[]``
                          and ``access-policy.start-item`` auto-deref
                          into ``policy-item`` so ``.apm.access-policy
                          [].start-item.caption`` Just Works.
  .cm.<kind>              Cluster Manager: ``cert``, ``key``,
                          ``device``, ``device-group``,
                          ``traffic-group``, ``trust-domain``.
                          PathRefs from ``device.cert`` /
                          ``device.key`` and ``trust-domain.ca-cert``
                          / ``ca-key`` / ``ca-devices[]`` /
                          ``trust-group`` auto-deref so
                          ``.cm.trust-domain[].trust-group.devices``
                          walks ``trust-domain → device-group →
                          devices`` in one chain.
  .gtm.<kind>             Global Traffic Manager (DNS):
                          ``datacenter``, ``server``, ``pool``,
                          ``wideip``, ``prober-pool``, ``region``,
                          ``rule``.  ``pool`` and ``wideip`` merge
                          all DNS record types (``a / aaaa / cname /
                          mx / srv / naptr``) into one container; the
                          DNS record type is exposed as
                          ``.record-type``.  PathRefs from
                          ``server.datacenter``,
                          ``wideip.pools[]`` / ``last-resort-pool``,
                          and ``prober-pool.members[]`` auto-deref
                          so chained queries like
                          ``.gtm.wideip[].pools[].ttl`` walk
                          ``wideip → pool → ttl`` in one step.
  .pem.<kind>             Policy Enforcement Manager: ``policy``,
                          ``irule``, ``listener``,
                          ``forwarding-endpoint``,
                          ``interception-endpoint``,
                          ``service-chain-endpoint``, ``profile``,
                          ``rating-group``, plus ``global-settings-*``,
                          ``protocol-*``, ``reporting-format-script``,
                          ``subscriber``, ``subscriber-attribute``.
  .auth.<kind>            Authentication: ``partition``, ``user``,
                          ``ldap``, ``radius``, ``radius-server``,
                          ``tacacs``, ``apm-auth``, ``cert-ldap``,
                          plus singletons (``password``,
                          ``password-policy``, ``source``,
                          ``remote-role``, ``remote-user``,
                          ``login-failures``).
  .vcmp.<kind>            vCMP: ``guest``, ``traffic-profile``,
                          ``virtual-disk``, ``virtual-disk-template``.
  .cli.<kind>             CLI: ``admin-partitions``,
                          ``alias-private``, ``alias-shared``,
                          ``global-settings``, ``preference``,
                          ``script``, ``transaction``, ``version``.
  .api-protection.<kind>  API Protection: ``profile-apiprotection``,
                          ``response``, ``server``.
  .asm.<kind>             Application Security Manager: ``policy``.
  .ilx.<kind>             iRulesLX: ``global-settings`` (singleton).
  .wom.<kind>             WAN Optimization Manager (legacy):
                          ``endpoint-discovery`` (singleton).
  .analytics.<kind>       Analytics: ``global-settings`` (singleton).

  Any TMSH stanza the parser sees but no typed projection covers
  still lands in ``cfg.generic_objects`` with full byte ranges
  and is reachable via ``rename_partition`` / ``--scf`` source-
  level operations, but it is not navigable from the DSL.

ASSIGNMENT

  path = expr             Set the target field to ``expr`` (evaluated
                          against the outer input).
  path |= expr            "Update": set the target to ``path | expr``;
                          ``.`` inside expr is the current value.
  path += expr            Numeric add, string concat, or list append.
  path -= expr            Numeric sub, or remove items from a list.

Assigning to an object's identity field (``.name`` / ``."full-path"``)
auto-routes through the same engine ``f5 rename`` uses, rewriting
every reference to the object as well as its header.  A line like
``renamed X -> Y (N occurrences)`` is printed to stderr so the
multi-stanza rewrite is visible.

Writing into an iRule body in v1 is restricted to reference slots
(``.refs.pools[]`` etc.).  General command-argument rewriting is
deferred to v2.

OPERATORS AND PRECEDENCE

  Highest -> lowest:
    1. unary  '-', 'not'
    2. '*' '/'
    3. '+' '-'
    4. '==' '!=' '<' '<=' '>' '>='
    5. 'and'
    6. 'or'
    7. '|' (pipe)
    8. '=' '|=' '+=' '-=' (assignment)
    9. ';' (statement separator)

JQ COMPATIBILITY

  Core idioms match jq exactly:
    * ``.X[]`` is a stream-generator; ``|`` iterates it.
    * ``[ ... ]`` collects a stream into an array.
    * Bare builtin names (``length``, ``sort``, ``unique``) operate
      on ``.`` — equivalent to ``length(.)`` etc.
    * Plain lists pass through ``|`` whole — to iterate a list, use
      ``.[]`` (or pass it to a list-aware builtin like ``map``).

  Differences:
    * Function arguments are comma-separated, not semicolon-separated.
      ``sub(.name, "foo", "bar")`` rather than ``sub("foo"; "bar")``.
    * Stream-comma ``,`` and statement-semicolon ``;`` both
      concatenate their LHS and RHS values into one output stream.
      ``,`` joins within a pipeline (``.a, .b | length``); ``;``
      joins separate top-level statements that share the same root
      and observe each other's mutations (``rename(o, n); .x = y``).
    * Identifiers may contain ``-`` so TMSH-spelt keys like
      ``data-group`` and ``source-address-translation`` lex as a
      single bareword token — ``.source-address-translation`` parses
      as one field access, no quotes needed.  Quoting is only useful
      when the key would otherwise tokenise into something else
      (e.g. ``."full-path"`` so the ``.`` after ``full`` is not read
      as a field-access separator).
    * Regex matching has a dedicated subscript form ``["~pattern"]``
      rather than the ``test`` builtin.
    * Object-literal ``{ ... }`` constructors are supported (jq style:
      ``{ name, destination: .dest }`` builds a dict per input,
      ``{name}`` shorthand promotes ``.name``); string-interpolation
      ``"\(.x)"`` is not in v1 — use ``--json`` to render whole
      objects as structured output.

See also:
  --help-builtins      every function this DSL exposes
  --help-examples      a cookbook of common one-liners

F5 QUERY DSL — BUILTIN FUNCTIONS (267 total)

Each entry is name (arity). Arity is shown as N, MIN..MAX, or MIN+ for
variadic. For full signatures, prose, and examples see
docs/references/f5_query/ or run `f5 query --help-builtins NAME`.

[bigip]
  profile_default            (2..3)
  profile_defaults           (1..2)

[forensic]
  file                       (1)
  files                      (0)
  glob                       (1)
  grep                       (1..2)

[graph]
  check_partition_visibility (0)
  referenced_by              (1)
  references_to              (1)
  refs                       (1)

[math]
  abs                        (1)
  acos                       (1)
  acosh                      (1)
  asin                       (1)
  asinh                      (1)
  atan                       (1)
  atan2                      (2)
  atanh                      (1)
  cbrt                       (1)
  ceil                       (1)
  copysign                   (2)
  cos                        (1)
  cosh                       (1)
  drem                       (2)
  exp                        (1)
  exp10                      (1)
  exp2                       (1)
  expm1                      (1)
  fabs                       (1)
  fdim                       (2)
  floor                      (1)
  fma                        (3)
  fmax                       (2)
  fmin                       (2)
  fmod                       (2)
  frexp                      (1)
  gamma                      (1)
  hypot                      (2)
  infinite                   (0)
  isinfinite                 (1)
  isnan                      (1)
  isnormal                   (1)
  j0                         (1)
  j1                         (1)
  jn                         (2)
  ldexp                      (2)
  lgamma                     (1)
  lgamma_r                   (1)
  log                        (1)
  log10                      (1)
  log1p                      (1)
  log2                       (1)
  logb                       (1)
  modf                       (1)
  nan                        (0)
  nearbyint                  (1)
  pow                        (2)
  pow10                      (1)
  remainder                  (2)
  rint                       (1)
  round                      (1)
  significand                (1)
  sin                        (1)
  sinh                       (1)
  sqrt                       (1)
  tan                        (1)
  tanh                       (1)
  tgamma                     (1)
  trunc                      (1)
  y0                         (1)
  y1                         (1)
  yn                         (2)

[net]
  broadcast_address          (1)
  can_see                    (2)
  collapse_cidrs             (1)
  dns                        (1)
  first_host                 (1)
  folder                     (1)
  host                       (1)
  host_count                 (1)
  http_body                  (1)
  http_body_json             (1)
  http_client_error          (1)
  http_header                (2)
  http_headers               (1)
  http_ok                    (1)
  http_redirect              (1)
  http_server_error          (1)
  http_status                (1)
  in_cidr                    (2)
  in_folder                  (2)
  in_partition               (2)
  ip                         (1..2)
  ip_range_contains          (2)
  ip_range_count             (1)
  ip_range_supernet          (1)
  ip_range_to_cidrs          (1)
  ip_translate               (3)
  is_documentation           (1)
  is_fqdn                    (1)
  is_ipv4                    (1)
  is_ipv6                    (1)
  is_link_local              (1)
  is_loopback                (1)
  is_multicast               (1)
  is_private                 (1)
  is_public                  (1)
  is_reserved                (1)
  is_unspecified             (1)
  is_wildcard_port           (1)
  last_host                  (1)
  net                        (1)
  network_address            (1)
  overlaps                   (2)
  ping                       (1)
  port                       (1)
  port_set_contains          (2)
  port_set_count             (1)
  port_set_overlaps          (2)
  portping                   (2..3)
  prefix_length              (1)
  rev_dns                    (1)
  route_domain               (1)
  socket_get                 (2..3)
  subnet_of                  (2)
  supernet_of                (1)
  tls_handshake              (2..3)
  traceroute                 (1)
  ucs_cert                   (1)
  url_get                    (1..2)
  url_head                   (1..2)
  url_options                (1..2)
  url_post                   (1..3)
  with_folder                (2)
  with_host                  (2)
  with_name                  (2)
  with_port                  (2)
  with_route_domain          (2)
  x509_eq                    (2)
  x509_from_config           (1)
  x509_parse                 (1)

[path]
  basename                   (1)
  partition                  (1)
  with_partition             (2)

[rename]
  rename                     (2)
  rename_folder              (2)
  rename_partition           (2)
  rename_prefix              (2)

[stream]
  IN                         (1+)
  INDEX                      (1..2)
  add                        (1)
  all                        (1)
  any                        (1)
  combinations               (0..1)
  count                      (1)
  debug                      (0..1)
  dupes                      (1)
  empty                      (0)
  error                      (0..1)
  first                      (1)
  flatten                    (0..1)
  group_by                   (1)
  halt                       (0)
  halt_error                 (0..1)
  inside                     (2)
  keys                       (1)
  keys_unsorted              (1)
  last                       (1)
  limit                      (2)
  map                        (1)
  map_values                 (1)
  max                        (1)
  max_by                     (1)
  max_min                    (0..1)
  min                        (1)
  min_by                     (1)
  min_max                    (0..1)
  not                        (0)
  nth                        (2)
  range                      (1..3)
  reverse                    (1)
  select                     (1)
  sort                       (1)
  sort_by                    (1)
  stderr                     (0)
  unique                     (1)
  unique_by                  (1)
  values                     (1)

[string]
  ascii                      (1)
  ascii_downcase             (1)
  ascii_upcase               (1)
  base64                     (1)
  base64d                    (1)
  capture                    (2..3)
  contains                   (2)
  csv                        (1+)
  downcase                   (1)
  endswith                   (2)
  explode                    (1)
  fromjson                   (1)
  gsub                       (3..4)
  html                       (1)
  implode                    (1)
  index                      (2)
  join                       (2)
  ltrimstr                   (2)
  match                      (2)
  rtrimstr                   (2)
  scan                       (2..3)
  sh                         (1)
  split                      (2)
  splits                     (2..3)
  startswith                 (2)
  sub                        (3..4)
  test                       (2..3)
  tojson                     (1)
  tonumber                   (1)
  tostring                   (1)
  tsv                        (1+)
  upcase                     (1)
  uri                        (1)
  utf8bytelength             (1)

[time]
  date                       (1)
  dateadd                    (2)
  datesub                    (2)
  fromdate                   (1)
  fromdateiso8601            (1)
  gmtime                     (1)
  localtime                  (1)
  mktime                     (1)
  now                        (0)
  strftime                   (2)
  strptime                   (2)
  todate                     (1)
  todateiso8601              (1)

[value]
  cert_load                  (1..2)
  csv_load                   (1..2)
  defined                    (1)
  del                        (1)
  delpaths                   (1)
  env                        (0)
  f5log_load                 (1)
  from_entries               (1)
  getpath                    (1)
  has                        (2)
  in                         (2)
  json_load                  (1)
  json_parse                 (1)
  jsonl_load                 (1)
  kind                       (1)
  leaf_paths                 (0)
  length                     (1)
  path                       (1)
  paths                      (0..1)
  pick                       (1+)
  profile_order              (1)
  recurse                    (0..2)
  recurse_down               (0)
  repeat                     (1)
  setpath                    (2)
  source_file                (1)
  str                        (1)
  to_entries                 (1)
  type                       (1)
  until                      (2)
  walk                       (1)
  with_entries               (1)

F5 QUERY DSL — COOKBOOK

  1. List every virtual server's default pool
     $ f5 query '.ltm.virtual[] | .pool' bigip.conf
     -- Streams every VS, projects its `pool` field as a path-ref.

  2. Names of VSes whose name starts with ``vs_prod_``
     $ f5 query '.ltm.virtual["~/vs_prod_"] | .name' bigip.conf
     -- Regex subscript filters keys; the dot-chain projects the name.

  3. VSes attached to a specific iRule
     $ f5 query '.ltm.virtual[] | select(contains(.rules, "/Common/log_rule")) | .name' bigip.conf
     -- `contains` works on both strings and lists.

  4. VSes whose pool member is in 10.0.0.0/8
     $ f5 query '.ltm.virtual[] | select(any(.pool.members[].address | in_cidr(., "10.0.0.0/8"))) | .name' bigip.conf
     -- PathRefs dereference transparently: `.pool.members[]` walks VS -> pool -> members in one chain.  The pipe iterates the stream of addresses, `in_cidr` runs per item producing booleans, `any` collapses.

  5. Readdress every VS into 192.168.9.0/24, keeping host bits
     $ f5 query '.ltm.virtual[] | .destination |= ip("192.168.9.0/24", .)' bigip.conf
     -- `|=` re-binds `.` to the current destination so the rebase helper sees the value it must transform.  `f5 query` shows a unified diff by default; pass --write to apply.

  6. Rename a pool everywhere it appears
     $ f5 query '.ltm.pool["/Common/old_pool"].name = "/Common/new_pool"' bigip.conf
     -- Identity-field writes auto-route through the same engine `f5 rename` uses, so every reference (VS, iRule, data-group) moves with the pool.

  7. Add ``/Common/log_rule`` to every VS that does not already have it
     $ f5 query '.ltm.virtual[] | select(not contains(.rules, "/Common/log_rule")) | .rules += "/Common/log_rule"' bigip.conf
     -- `not` is a prefix operator on the predicate; `+=` appends a scalar (or another list) to a list field.

  8. Find every iRule that mentions a removed pool
     $ f5 query '.ltm.rule[] | select(contains(.refs.pools, "/Common/old_pool")) | .name' bigip.conf
     -- The iRule sub-tree exposes parsed ref slots without sub-parsing every command.

  9. Strip the ``/Common/`` partition from every default pool
     $ f5 query '.ltm.virtual[].pool |= basename(.)' bigip.conf
     -- One-line projection-then-rewrite using `|=` plus the path helper.

  10. Rename a single object everywhere (the engine `f5 rename` uses)
     $ f5 query 'rename("/Common/old_pool", "/Common/new_pool")' bigip.conf
     -- Same token-bounded rewrite the `f5 rename` verb runs; tolerant of zero-match (returns 0) so the CLI can surface it as a warning rather than an error.

  11. Migrate every object from /Tenant_A/ into /Tenant_B/
     $ f5 query 'rename_partition("Tenant_A", "Tenant_B")' bigip.conf
     -- Token-bounded prefix rewrite — every object header and every reference (including destination addresses, pool members, and iRule body literals) moves together.  Renames the `auth partition Tenant_A` stanza too.  The visibility model refuses renames involving `/Common` (every tenant sees `/Common` one-way) so examples stay tenant→tenant.

  12. Move every pool out of /Common/ but leave other kinds alone
     $ f5 query '.ltm.pool["~^/Common/"] | .name |= with_partition(., "Tenant_A")' bigip.conf
     -- Identity-field `|=` routes through the rename engine; only the pools (and references *to* them) move, virtuals and iRules keep their partition.

  13. Set the route domain on every destination
     $ f5 query '.ltm.virtual[] | .destination |= with_route_domain(., 7)' bigip.conf
     -- Route domain is part of the routable identity; `with_route_domain` sets, replaces, or strips it while preserving partition prefix and port.

  14. Readdress with a route domain preserved through the rebase
     $ f5 query '.ltm.virtual[] | .destination |= ip("192.168.9.0/24", .)' bigip.conf
     -- `ip(net, src)` keeps the route domain and port from `src` and only rebases the address bits — `%5` survives the subnet move.

  15. Count VSes grouped by partition
     $ f5 query '[.ltm.virtual[]] | group_by(partition(."full-path")) | map({partition: (.[0]."full-path" | partition(.)), count: length})' bigip.conf
     -- `group_by(partition(."full-path"))` partitions the stream of VSes by their partition string; `map` then projects each group to `{partition, count}` using `length` to count and `.[0]."full-path" | partition(.)` to recover the partition label.  For the flat-list variant, ``[.ltm.virtual[]."full-path" | partition(.)] | unique`` yields the distinct partition names sorted.

  16. Park every dev VS on port 0 (a common maintenance trick)
     $ f5 query '.ltm.virtual[] | select(contains(.name, "_dev_")) | .destination |= sub(., ":[0-9]+$", ":0")' bigip.conf
     -- Arbitrary string rewriting via `sub` / `gsub` lands as a normal field edit.  Pair with `--in-place` to persist.

  17. Cross-reference GTM and LTM via named sources
     $ f5 query '$ltm.ltm.virtual[].name' bigip.conf
     -- Load several configs together (`f5 query ... gtm.conf ltm.conf`).  Every input is auto-bound under its filename stem so `$ltm` and `$gtm` work without ceremony; override with `--name N=PATH` when the stem would collide or read poorly.

  18. Edit one source via $name from a multi-config invocation
     $ f5 query '$ltm.ltm.virtual["/Common/vs_app"].destination = "/Common/192.168.1.1:443"' bigip.conf
     -- The assignment routes back to the source the named root came from, so only `ltm.conf` is modified even though `gtm.conf` was loaded alongside it.  Pair with `--in-place` to persist edits to each originating file.

  19. Walk references across files with --merge
     $ f5 query '.ltm.pool[] | referenced_by(.)' bigip.conf
     -- `--merge` treats every loaded source as one namespace, so `refs` / `referenced_by` cross files (a GTM pool pointing into an LTM virtual resolves transparently).  Refuses to merge when two sources define the same (kind, full-path) — namespace or redact the inputs first.

  20. Pool names attached to more than one VS
     $ f5 query '[.ltm.virtual[].pool] | dupes' bigip.conf
     -- ``dupes`` is the inverse of ``unique`` — returns the values that occur **more than once** in the list, sorted.  Useful for surfacing intentional sharing (or copy-paste bugs).

  21. VSes sorted ascending by attached pool member count
     $ f5 query '[.ltm.virtual[]] | sort_by(.pool.members | length) | map(.name)' bigip.conf
     -- ``sort_by(body)`` orders a list by the value of *body* evaluated against each item.  Pair with ``map`` to project the field you care about.

  22. Largest pool by member count, in one pass
     $ f5 query '[.ltm.pool[]] | max_by(.members | length)' bigip.conf
     -- ``max_by(body)`` picks the item whose *body* value is largest under jq's cross-type ordering.  Use ``min_by`` for the opposite extreme and ``min_max(body)`` to get both in one array.

  23. Lowercase every string field anywhere in a VS, recursively
     $ f5 query '.ltm.virtual.web_vs | walk(if type == "string" then ascii_downcase else . end)' bigip.conf
     -- ``walk(body)`` is jq's recursive transform — for every value in the tree (bottom-up), it rebinds ``.`` to that value and evaluates *body*.  Pair with ``type`` and ``ascii_downcase`` / ``ascii_upcase`` for case normalisation across an entire object.

  24. Index VSes by name for O(1) lookup in downstream pipelines
     $ f5 query '[.ltm.virtual[]] | INDEX(.name)' bigip.conf
     -- ``INDEX`` builds an object keyed by the result of *body* evaluated against each item — here the VS name.  jq's two-arg form ``INDEX(source; key)`` uses ``;`` as the argument separator; in this DSL function arguments are comma-separated, so collect the stream first and pipe.

More: see docs/kcs/features/kcs-feature-bigip-query.md
      and docs/references/f5_query/dsl.md