CategoryFeatureDescription
Aggregation functionarg_maxReturns the row where an expression evaluates to the maximum value.
Aggregation functionarg_minReturns the row where an expression evaluates to the minimum value.
Aggregation functionavgReturns an average value across the group.
Aggregation functionavgifCalculates the average value of an expression in records for which the predicate evaluates to true.
Aggregation functioncountReturns a count of the group without/with a predicate.
Aggregation functioncountifReturns a count of rows for which the predicate evaluates to true.
Aggregation functiondcountReturns an estimate for the number of distinct values that are taken by a scalar expression in the summary group.
Aggregation functiondcountifReturns an estimate of the number of distinct values of an expression of rows for which the predicate evaluates to true.
Aggregation functionhistogramReturns a timeseries heatmap chart across the group.
Aggregation functionmake_list_ifCreates a dynamic JSON object (array) of an expression values in the group for which the predicate evaluates to true.
Aggregation functionmake_listCreates a dynamic JSON object (array) of all the values of an expression in the group.
Aggregation functionmake_set_ifCreates a dynamic JSON object (array) of the set of distinct values that an expression takes in records for which the predicate evaluates to true.
Aggregation functionmake_setCreates a dynamic JSON array of the set of distinct values that an expression takes in the group.
Aggregation functionmaxReturns the maximum value across the group.
Aggregation functionmaxifCalculates the maximum value of an expression in records for which the predicate evaluates to true.
Aggregation functionminReturns the minimum value across the group.
Aggregation functionminifReturns the minimum of an expression in records for which the predicate evaluates to true.
Aggregation functionpercentileCalculates the requested percentiles of the group and produces a timeseries chart.
Aggregation functionpercentileifCalculates the requested percentiles of the field for the rows where the predicate evaluates to true.
Aggregation functionpercentiles_arrayReturns an array of numbers where each element is the value at the corresponding percentile.
Aggregation functionpercentiles_arrayifReturns an array of percentile values for the records that satisfy the condition.
Aggregation functionrateCalculates the rate of values in a group per second.
Aggregation functionstdevCalculates the standard deviation of an expression across the group.
Aggregation functionstdevifCalculates the standard deviation of an expression in records for which the predicate evaluates to true.
Aggregation functionsumCalculates the sum of an expression across the group.
Aggregation functionsumifCalculates the sum of an expression in records for which the predicate evaluates to true.
Aggregation functiontopkCalculates the top values of an expression across the group in a dataset.
Aggregation functiontopkifCalculates the top values of an expression in records for which the predicate evaluates to true.
Aggregation functionvarianceCalculates the variance of an expression across the group.
Aggregation functionvarianceifCalculates the variance of an expression in records for which the predicate evaluates to true.
Array functionarray_concatConcatenates arrays into one.
Array functionarray_extractExtracts values from a nested array.
Array functionarray_iffFilters array by condition.
Array functionarray_index_ofReturns index of item in array.
Array functionarray_lengthReturns length of array.
Array functionarray_reverseReverses array elements.
Array functionarray_rotate_leftRotates array values to the left.
Array functionarray_rotate_rightRotates array values to the right.
Array functionarray_select_dictSelects dictionary from array of dictionaries.
Array functionarray_shift_leftShifts array values to the left.
Array functionarray_shift_rightShifts array values to the right.
Array functionarray_sliceReturns slice of an array.
Array functionarray_sort_ascSorts an array in ascending order.
Array functionarray_sort_descSorts an array in descending order.
Array functionarray_splitSplits array by indices.
Array functionarray_sumSums array elements.
Array functionbag_has_keyChecks if dynamic object has a specific key.
Array functionbag_keysReturns keys of a dynamic property bag.
Array functionbag_packCreates a dynamic property bag from key-value pairs.
Array functionisarrayChecks if value is an array.
Array functionlenReturns array or string length.
Array functionpack_arrayPacks input into a dynamic array.
Array functionpack_dictionaryReturns a dictionary from key-value mappings.
Array functionstrcat_arrayJoins array elements into a string using a delimiter.
Conditional functioncaseEvaluates conditions and returns the first matched result.
Conditional functioniffReturns one of two values based on predicate.
Conversion functiondynamic_to_jsonConverts dynamic value to JSON string.
Conversion functionensure_fieldReturns value of field or typed null.
Conversion functionisboolChecks if expression evaluates to boolean.
Conversion functiontoarrayConverts to array.
Conversion functiontoboolConverts to boolean.
Conversion functiontodatetimeConverts to datetime.
Conversion functiontodoubleConverts to real.
Conversion functiontodynamicConverts to dynamic.
Conversion functiontohexConverts to hexadecimal string.
Conversion functiontointConverts to integer.
Conversion functiontolongConverts to signed 64-bit long.
Conversion functiontorealConverts to real.
Conversion functiontostringConverts to string.
Conversion functiontotimespanConverts to timespan.
Datetime functionagoSubtracts timespan from current time.
Datetime functiondatetime_addAdds amount to datetime.
Datetime functiondatetime_diffDifference between two datetimes.
Datetime functiondatetime_partExtracts part of a datetime.
Datetime functiondayofmonthDay number in month.
Datetime functiondayofweekDays since previous Sunday.
Datetime functiondayofyearDay number in year.
Datetime functionendofdayReturns end of day.
Datetime functionendofmonthReturns end of month.
Datetime functionendofweekReturns end of week.
Datetime functionendofyearReturns end of year.
Datetime functiongetmonthMonth of a datetime.
Datetime functiongetyearYear of a datetime.
Datetime functionhourofdayHour number of the day.
Datetime functionmonthofyearMonth number of year.
Datetime functionnowReturns current UTC time.
Datetime functionstartofdayReturns start of day.
Datetime functionstartofmonthReturns start of month.
Datetime functionstartofweekReturns start of week.
Datetime functionstartofyearReturns start of year.
Datetime functionunixtime_microseconds_todatetimeConverts microsecond Unix timestamp to datetime.
Datetime functionunixtime_milliseconds_todatetimeConverts millisecond Unix timestamp to datetime.
Datetime functionunixtime_nanoseconds_todatetimeConverts nanosecond Unix timestamp to datetime.
Datetime functionunixtime_seconds_todatetimeConverts second Unix timestamp to datetime.
Datetime functionweek_of_yearReturns the ISO 8601 week number from a datetime expression.
Hash functionhash_md5Returns MD5 hash.
Hash functionhash_sha1Returns SHA1 hash.
Hash functionhash_sha256Returns SHA256 hash.
Hash functionhash_sha512Returns SHA512 hash.
Hash functionhashReturns integer hash of input.
IP functionformat_ipv4_maskFormats IPv4 and mask to CIDR.
IP functionformat_ipv4Formats netmask into IPv4 string.
IP functiongeo_info_from_ip_addressExtracts geolocation from IP address.
IP functionhas_any_ipv4_prefixChecks if IPv4 starts with any prefix.
IP functionhas_any_ipv4Checks if any of given IPv4s exist in column.
IP functionhas_ipv4_prefixChecks if IPv4 starts with specified prefix.
IP functionhas_ipv4Checks if IPv4 is valid and in source text.
IP functionipv4_compareCompares two IPv4 addresses.
IP functionipv4_is_in_any_rangeChecks if IPv4 is in any specified range.
IP functionipv4_is_in_rangeChecks if IPv4 is in a given range.
IP functionipv4_is_matchMatches IPv4 against a pattern.
IP functionipv4_is_privateChecks if IPv4 is private.
IP functionipv4_netmask_suffixExtracts netmask suffix.
IP functionipv6_compareCompares two IPv6 addresses.
IP functionipv6_is_in_any_rangeChecks if IPv6 is in any range.
IP functionipv6_is_in_rangeChecks if IPv6 is in range.
IP functionipv6_is_matchChecks if IPv6 matches pattern.
IP functionparse_ipv4_maskConverts IPv4 and mask to long integer.
IP functionparse_ipv4Converts IPv4 to long integer.
Logical operator!=Returns true if either one (or both) of the operands are null, or they are not equal to each other. Otherwise, false.
Logical operator==Returns true if both operands are non-null and equal to each other. Otherwise, false.
Logical operatorandReturns true if both operands are true.
Logical operatororReturns true if one of the operands is true, regardless of the other operand.
Mathematical functionabsReturns absolute value.
Mathematical functionacosReturns arccosine of a number.
Mathematical functionasinReturns arcsine of a number.
Mathematical functionatanReturns arctangent of a number.
Mathematical functionatan2Returns angle between x-axis and point (y, x).
Mathematical functioncosReturns cosine of a number.
Mathematical functiondegreesConverts radians to degrees.
Mathematical functionexpReturns e^x.
Mathematical functionexp10Returns 10^x.
Mathematical functionexp2Returns 2^x.
Mathematical functiongammaReturns gamma function of x.
Mathematical functionisinfReturns true if x is infinite.
Mathematical functionisintReturns true if x is an integer.
Mathematical functionisnanReturns true if x is NaN.
Mathematical functionlogReturns natural logarithm of x.
Mathematical functionlog10Returns base-10 logarithm.
Mathematical functionlog2Returns base-2 logarithm.
Mathematical functionloggammaReturns log of absolute gamma function.
Mathematical functionmax_ofReturns largest value among arguments.
Mathematical functionmin_ofReturns smallest value among arguments.
Mathematical functionnotReverses boolean value.
Mathematical functionpiReturns value of Pi.
Mathematical functionpowReturns value raised to a power.
Mathematical functionradiansConverts degrees to radians.
Mathematical functionrandReturns pseudo-random numbers between 0 (inclusive) and 1 (exclusive).
Mathematical functionroundRounds value to given precision.
Mathematical functionset_differenceReturns array difference.
Mathematical functionset_has_elementReturns true if set contains an element.
Mathematical functionset_intersectReturns array intersection.
Mathematical functionset_unionReturns array union.
Mathematical functionsignReturns sign of number.
Mathematical functionsinReturns sine of a number.
Mathematical functionsqrtReturns square root of a number.
Mathematical functiontanReturns tangent of a number.
Numerical operator-Subtract. Example: 0.26 - 0.23
Numerical operator!=Not equals. Example: 2 != 1
Numerical operator!inNot equals to any of the elements. Example: "bca" !in ("123", "345", "abc")
Numerical operator*Multiply. Example: 1s * 5, 5 * 5
Numerical operator/Divide. Example: 10m / 1s, 4 / 2
Numerical operator<Less. Example: 1 < 2, 1 <= 1
Numerical operator<=Less or Equal. Example: 5 <= 6
Numerical operator%Modulo. Example: 10 % 3, 5 % 2
Numerical operator+Add. Example: 3.19 + 3.19, ago(10m) + 10m
Numerical operator==Equals. Example: 3 == 3
Numerical operator>Greater. Example: 0.23 > 0.22, now() > ago(1d)
Numerical operator>=Greater or Equal. Example: 7 >= 6
Numerical operatorinEquals to one of the elements. Example: "abc" in ("123", "345", "abc")
Rounding functionbin_autoRounds values down to a bin based on query-provided size and alignment.
Rounding functionbinRounds values down to a bin size.
Rounding functionceilingReturns the smallest integer greater than or equal to the specified number.
Rounding functionfloorReturns the largest integer less than or equal to the specified number.
SQL functionformat_sqlConverts parsed SQL data model back into SQL statement.
SQL functionparse_sqlParses and analyzes SQL queries.
String functionbase64_decode_toarrayDecodes a Base64-encoded string into an array of bytes.
String functionbase64_decode_tostringDecodes a base64 string to a UTF-8 string.
String functionbase64_encode_fromarrayConverts a sequence of bytes into a Base64-encoded string.
String functionbase64_encode_tostringEncodes a string as base64 string.
String functioncoalesceReturns the first non-null/non-empty value from a list.
String functioncountof_regexCounts occurrences of a regex in a string.
String functioncountofCounts occurrences of a substring in a string.
String functionextract_allGets all matches for a regular expression from a text string.
String functionextractGets a match for a regular expression from a text string.
String functionformat_bytesFormats a number of bytes as a string including units.
String functionformat_urlFormats a string into a valid URL.
String functiongettypeReturns the runtime type of an argument.
String functionindexofReturns index of the first occurrence of a substring.
String functionisasciiReturns true if all characters in an input string are ASCII characters.
String functionisemptyReturns true if the argument is empty or null.
String functionisnotemptyReturns true if the argument is not empty or null.
String functionisnotnullReturns true if the argument is not null.
String functionisnullReturns true if the argument is null.
String functionparse_bytesParses byte-size string to number of bytes.
String functionparse_csvSplits a CSV-formatted string into an array.
String functionparse_jsonParses a string as a JSON value.
String functionparse_urlParses a URL string and returns parts in a dynamic object.
String functionparse_urlqueryParses a URL query string into key-value pairs.
String functionquoteReturns a string representing the input enclosed in double quotes, with internal quotes and escape sequences handled appropriately.
String functionreplace_regexReplaces regex matches with another string.
String functionreplace_stringReplaces string matches with another string.
String functionreplaceReplaces all regex matches with another string.
String functionreverseReverses a string.
String functionsplitSplits a string into an array using a delimiter.
String functionstrcat_delimConcatenates 2–64 arguments with a delimiter.
String functionstrcatConcatenates 1–64 arguments.
String functionstrcmpCompares two strings.
String functionstrlenReturns the length of a string.
String functionstrrepRepeats a string a given number of times.
String functionsubstringExtracts a substring.
String functiontolowerConverts string to lowercase.
String functiontotitleConverts string to title case.
String functiontoupperConverts string to uppercase.
String functiontrim_end_regexTrims trailing characters using regex.
String functiontrim_endTrims trailing characters.
String functiontrim_regexTrims characters matching a regex.
String functiontrim_spaceRemoves all leading and trailing whitespace from a string.
String functiontrim_start_regexTrims leading characters using regex.
String functiontrim_startTrims leading characters.
String functiontrimTrims leading/trailing characters.
String functionurl_decodeDecodes a URL-encoded string.
String functionurl_encodeEncodes characters into a URL-friendly format.
String operator!=Not equals (case-sensitive). Example: "abc" != "ABC"
String operator!~Not equals (case-insensitive). Example: "aBc" !~ "xyz"
String operator!contains_csRHS doesn’t occur in LHS (case-sensitive). Example: "parentSpanId" !contains_cs "Id"
String operator!containsRHS doesn’t occur in LHS (case-insensitive). Example: "parentSpanId" !contains "abc"
String operator!endswith_csRHS isn’t a closing subsequence of LHS (case-sensitive). Example: "parentSpanId" !endswith_cs "Span"
String operator!endswithRHS isn’t a closing subsequence of LHS (case-insensitive). Example: "parentSpanId" !endswith "Span"
String operator!has_csRHS isn’t a whole term in LHS (case-sensitive). Example: "North America" !has_cs "America"
String operator!hasRHS isn’t a whole term in LHS (case-insensitive). Example: "North America" !has "america"
String operator!hasprefix_csLHS string doesn’t start with the RHS string (case-sensitive). Example: "DOCS_file" !hasprefix_cs "DOCS"
String operator!hasprefixLHS string doesn’t start with the RHS string (case-insensitive). Example: "Admin_User" !hasprefix "Admin"
String operator!hassuffix_csLHS string doesn’t end with the RHS string (case-sensitive). Example: "Document.HTML" !hassuffix_cs ".HTML"
String operator!hassuffixLHS string doesn’t end with the RHS string (case-insensitive). Example: "documentation.docx" !hassuffix ".docx"
String operator!inNot equals to any of the elements (case-sensitive). Example: "bca" !in ("123", "345", "abc")
String operator!in~Not equals to any of the elements (case-insensitive). Example: "bca" !in~ ("123", "345", "ABC")
String operator!matches regexLHS doesn’t contain a match for RHS. Example: "parentSpanId" !matches regex "g.*r"
String operator!startswith_csRHS isn’t an initial subsequence of LHS (case-sensitive). Example: "parentSpanId" !startswith_cs "parent"
String operator!startswithRHS isn’t an initial subsequence of LHS (case-insensitive). Example: "parentSpanId" !startswith "Id"
String operator==Equals (case-sensitive). Example: "aBc" == "aBc"
String operator=~Equals (case-insensitive). Example: "abc" =~ "ABC"
String operatorcontains_csRHS occurs as a subsequence of LHS (case-sensitive). Example: "parentSpanId" contains_cs "Id"
String operatorcontainsRHS occurs as a subsequence of LHS (case-insensitive). Example: "parentSpanId" contains "Span"
String operatorendswith_csRHS is a closing subsequence of LHS (case-sensitive). Example: "parentSpanId" endswith_cs "Id"
String operatorendswithRHS is a closing subsequence of LHS (case-insensitive). Example: "parentSpanId" endswith "Id"
String operatorhas_csRHS is a whole term in LHS (case-sensitive). Example: "North America" has_cs "America"
String operatorhasRHS is a whole term in LHS (case-insensitive). Example: "North America" has "america"
String operatorhasprefix_csLHS string starts with the RHS string (case-sensitive). Example: "DOCS_file" hasprefix_cs "DOCS"
String operatorhasprefixLHS string starts with the RHS string (case-insensitive). Example: "Admin_User" hasprefix "Admin"
String operatorhassuffix_csLHS string ends with the RHS string (case-sensitive). Example: "Document.HTML" hassuffix_cs ".HTML"
String operatorhassuffixLHS string ends with the RHS string (case-insensitive). Example: "documentation.docx" hassuffix ".docx"
String operatorinEquals to one of the elements (case-sensitive). Example: "abc" in ("123", "345", "abc")
String operatorin~Equals to one of the elements (case-insensitive). Example: "abc" in~ ("123", "345", "ABC")
String operatormatches regexLHS contains a match for RHS. Example: "parentSpanId" matches regex "g.*r"
String operatorstartswith_csRHS is an initial subsequence of LHS (case-sensitive). Example: "parentSpanId" startswith_cs "parent"
String operatorstartswithRHS is an initial subsequence of LHS (case-insensitive). Example: "parentSpanId" startswith "parent"
Tabular operatorcountReturns an integer representing the total number of records in the dataset.
Tabular operatordistinctReturns a dataset with unique values from the specified fields, removing any duplicate entries.
Tabular operatorextend-validReturns a table where the specified fields are extended with new values based on the given expression for valid rows.
Tabular operatorextendReturns the original dataset with one or more new fields appended, based on the defined expressions.
Tabular operatorexternaldataReturns a table with the specified schema, containing data retrieved from an external source.
Tabular operatorgetschemaReturns the schema of a dataset, including field names and their data types.
Tabular operatorjoinReturns a dataset containing rows from two different tables based on conditions.
Tabular operatorlimitReturns the top N rows from the input dataset.
Tabular operatorlookupReturns a dataset where rows from one dataset are enriched with matching columns from a lookup table based on conditions.
Tabular operatororderReturns the input dataset, sorted according to the specified fields and order.
Tabular operatorparseReturns the input dataset with new fields added based on the specified parsing pattern.
Tabular operatorproject-awayReturns the input dataset excluding the specified fields.
Tabular operatorproject-keepReturns a dataset with only the specified fields.
Tabular operatorproject-reorderReturns a table with the specified fields reordered as requested followed by any unspecified fields in their original order.
Tabular operatorprojectReturns a dataset containing only the specified fields.
Tabular operatorredactReturns the input dataset with sensitive data replaced or hashed.
Tabular operatorsampleReturns a table containing the specified number of rows, selected randomly from the input dataset.
Tabular operatorsearchReturns all rows where the specified keyword appears in any field.
Tabular operatorsortReturns a table with rows ordered based on the specified fields.
Tabular operatorsummarizeReturns a table where each row represents a unique combination of values from the by fields, with the aggregated results calculated for the other fields.
Tabular operatortakeReturns the specified number of rows from the dataset.
Tabular operatortopReturns the top N rows from the dataset based on the specified sorting criteria.
Tabular operatorunionReturns all rows from the specified tables or queries.
Tabular operatorwhereReturns a filtered dataset containing only the rows where the condition evaluates to true.
Type functionisccChecks whether a value is a valid credit card (CC) number.
Type functionisimeiChecks whether a value is a valid International Mobile Equipment Identity (IMEI) number.
Type functionismapChecks whether a value is of the dynamic type and represents a mapping.
Type functionisrealChecks whether a value is a real number.
Type functionisstringChecks whether a value is a string.
Type functionisutf8Checks whether a value is a valid UTF-8 encoded sequence.