llm documentation

Author: mmguero

docs/README.md

@@ -99,7 +99,13 @@ Malcolm can also easily be deployed locally on an ordinary consumer workstation
     - [Alerting](alerting.md#Alerting)
         + [Email Sender Accounts](alerting.md#AlertingEmail)
         + [Event Logging Loopback API](api-event-logging.md)
-* [Search Queries in Arkime and OpenSearch Dashboards](queries-cheat-sheet.md)
+* [Search Queries in Arkime and OpenSearch Dashboards](queries-cheat-sheet.md#SearchSyntax)
+    - [Query Syntax Comparison "Cheat Sheet"](queries-cheat-sheet.md#SearchCheatSheet)
+    - [Arkime Query Syntax](queries-cheat-sheet.md#ArkimeQueries)
+    - [OpenSearch Dashboards Query Syntax](queries-cheat-sheet.md#DashboardsQueries)
+        + [Dashboards Query Language (DQL)](queries-cheat-sheet.md#DashboardsQueriesDQL)
+        + [Apache Lucene Query Parser Syntax](queries-cheat-sheet.md#DashboardsQueriesLucene)
+        + [SQL and PPL](queries-cheat-sheet.md#DashboardsSQLandPPL)
 * Other Malcolm features
     - [Analytics](analytics.md#Analytics)
     - [Custom Rules, Scripts and Plugins](custom-rules.md#CustomRulesAndScripts)