Docs
DocumentationQuery ReferenceAPI Reference
Open Console→→
DocumentationQuery ReferenceAPI Reference

Introduction

Query reference overview

APL

IntroductionSample queriesAll features
Functions
Scalar functions
Array functions
Overview
array_concat
array_extract
array_iff
array_index_of
array_length
array_reverse
array_rotate_left
array_rotate_right
array_select_dict
array_shift_left
array_shift_right
array_slice
array_sort_asc
array_sort_desc
array_split
array_sum
bag_has_key
bag_keys
bag_pack
bag_zip
isarray
len
pack_array
pack_dictionary
strcat_array
Conditional functions
Overview
case
iff
Conversion functions
Overview
dynamic_to_json
ensure_field
isbool
toarray
tobool
todatetime
todouble, toreal
todynamic
tohex
toint, tolong
tostring
totimespan
Datetime functions
Overview
ago
datetime_add
datetime_diff
datetime_part
dayofmonth
dayofweek
dayofyear
endofday
endofmonth
endofweek
endofyear
getmonth
getyear
hourofday
monthofyear
now
startofday
startofmonth
startofweek
startofyear
unixtime_microseconds_todatetime
unixtime_milliseconds_todatetime
unixtime_nanoseconds_todatetime
unixtime_seconds_todatetime
week_of_year
GenAI functions
Overview
genai_concat_contents
genai_conversation_turns
genai_cost
genai_estimate_tokens
genai_extract_assistant_response
genai_extract_function_results
genai_extract_system_prompt
genai_extract_tool_calls
genai_extract_user_prompt
genai_get_content_by_index
genai_get_content_by_role
genai_get_pricing
genai_get_role
genai_has_tool_calls
genai_input_cost
genai_is_truncated
genai_message_roles
genai_output_cost
Hash functions
Overview
hash
hash_md5
hash_sha1
hash_sha256
hash_sha512
IP functions
Overview
format_ipv4
format_ipv4_mask
geo_info_from_ip_address
has_any_ipv4
has_any_ipv4_prefix
has_ipv4
has_ipv4_prefix
ipv4_compare
ipv4_is_in_range
ipv4_is_in_any_range
ipv4_is_match
ipv4_is_private
ipv4_netmask_suffix
ipv6_compare
ipv6_is_in_any_range
ipv6_is_in_range
ipv6_is_match
parse_ipv4
parse_ipv4_mask
Mathematical functions
Overview
abs
acos
asin
atan
atan2
cos
cot
degrees
exp
exp2
exp10
gamma
isfinite
isinf
isint
isnan
log
log2
log10
loggamma
max_of
min_of
not
pi
pow
radians
rand
range
round
set_difference
set_has_element
set_intersect
set_union
sign
sin
sqrt
tan
Metadata functions
Overview
column_ifexists
cursor_current
ingestion_time
Pair functions
Overview
find_pair
pair
parse_pair
Rounding functions
Overview
bin
bin_auto
ceiling
floor
String functions
Overview
base64_decode_toarray
base64_decode_tostring
base64_encode_fromarray
base64_encode_tostring
coalesce
countof
countof_regex
extract
extract_all
format_bytes
format_url
gettype
indexof
indexof_regex
isascii
isempty
isnotempty
isnotnull
isnull
parse_bytes
parse_csv
parse_json
parse_path
parse_url
parse_urlquery
quote
regex_quote
replace
replace_regex
replace_string
reverse
split
strcat
strcat_delim
strcmp
string_size
strlen
strrep
strip_ansi_escapes
substring
tolower
totitle
toupper
translate
trim
trim_end
trim_end_regex
trim_regex
trim_space
trim_start
trim_start_regex
unicode_codepoints_from_string
unicode_codepoints_to_string
url_decode
url_encode
SQL functions
Overview
parse_sql
format_sql
Time series functions
Overview
series_abs
series_acos
series_add
series_asin
series_atan
series_ceiling
series_cos
series_cosine_similarity
series_divide
series_dot_product
series_equals
series_exp
series_fft
series_fill_backward
series_fill_const
series_fill_forward
series_fill_linear
series_fir
series_floor
series_greater
series_greater_equals
series_ifft
series_iir
series_less
series_less_equals
series_log
series_magnitude
series_max
series_min
series_multiply
series_not_equals
series_pearson_correlation
series_pow
series_sign
series_sin
series_stats
series_stats_dynamic
series_subtract
series_sum
series_tan
Type functions
Overview
isimei
ismap
isreal
iscc
isstring
isutf8
Aggregation functions
Overview
arg_min
arg_max
avg
avgif
count
countif
dcount
dcountif
histogram
histogramif
make_list
make_list_if
make_set
make_set_if
max
maxif
min
minif
percentile
percentileif
percentiles_array
percentiles_arrayif
phrases
rate
spotlight
stdev
stdevif
sum
sumif
topk
topkif
variance
varianceif
Operators
Tabular operators
Overview
count
distinct
extend
extend-valid
externaldata
getschema
join
limit
lookup
make-series
mv-expand
order
parse
parse-kv
parse-where
project
project-away
project-keep
project-rename
project-reorder
redact
sample
search
sort
summarize
take
top
union
where
Scalar operators
Set membership operators
Overview
in
!in
in~
!in~
Logical
Numerical
String
Reference
Entity names
Map fields
Null values
Scalar data types
Set statement
Special field attributes
Migrate
Splunk SPL
SQL
Sumo Logic

MPL

Language featuresSample queriesMigrate
APL

All features of Axiom Processing Language (APL)

This page gives an overview about all the features of Axiom Processing Language (APL).

CategoryFeatureDescription
Aggregation functionarg_maxReturns the row where an expression evaluates to the maximum value.
Aggregation functionarg_minReturns the row where an expression evaluates to the minimum value.
Aggregation functionavgReturns an average value across the group.
Aggregation functionavgifCalculates the average value of an expression in records for which the predicate evaluates to true.
Aggregation functioncountReturns a count of the group without/with a predicate.
Aggregation functioncountifReturns a count of rows for which the predicate evaluates to true.
Aggregation functiondcountReturns an estimate for the number of distinct values that are taken by a scalar expression in the summary group.
Aggregation functiondcountifReturns an estimate of the number of distinct values of an expression of rows for which the predicate evaluates to true.
Aggregation functionhistogramReturns a timeseries heatmap chart across the group.
Aggregation functionhistogramifCreates a histogram for rows where a condition evaluates to true.
Aggregation functionmake_list_ifCreates a dynamic JSON object (array) of an expression values in the group for which the predicate evaluates to true.
Aggregation functionmake_listCreates a dynamic JSON object (array) of all the values of an expression in the group.
Aggregation functionmake_set_ifCreates a dynamic JSON object (array) of the set of distinct values that an expression takes in records for which the predicate evaluates to true.
Aggregation functionmake_setCreates a dynamic JSON array of the set of distinct values that an expression takes in the group.
Aggregation functionmaxReturns the maximum value across the group.
Aggregation functionmaxifCalculates the maximum value of an expression in records for which the predicate evaluates to true.
Aggregation functionminReturns the minimum value across the group.
Aggregation functionminifReturns the minimum of an expression in records for which the predicate evaluates to true.
Aggregation functionpercentileCalculates the requested percentiles of the group and produces a timeseries chart.
Aggregation functionpercentileifCalculates the requested percentiles of the field for the rows where the predicate evaluates to true.
Aggregation functionpercentiles_arrayReturns an array of numbers where each element is the value at the corresponding percentile.
Aggregation functionpercentiles_arrayifReturns an array of percentile values for the records that satisfy the condition.
Aggregation functionrateCalculates the rate of values in a group per second.
Aggregation functionspotlightCompares a selected set of events against a baseline and surface the most significant differences.
Aggregation functionstdevCalculates the standard deviation of an expression across the group.
Aggregation functionstdevifCalculates the standard deviation of an expression in records for which the predicate evaluates to true.
Aggregation functionsumCalculates the sum of an expression across the group.
Aggregation functionsumifCalculates the sum of an expression in records for which the predicate evaluates to true.
Aggregation functiontopkCalculates the top values of an expression across the group in a dataset.
Aggregation functiontopkifCalculates the top values of an expression in records for which the predicate evaluates to true.
Aggregation functionvarianceCalculates the variance of an expression across the group.
Aggregation functionvarianceifCalculates the variance of an expression in records for which the predicate evaluates to true.
Aggregation functionphrasesExtracts and counts common phrases or word sequences from text fields.
Array functionarray_concatConcatenates arrays into one.
Array functionarray_extractExtracts values from a nested array.
Array functionarray_iffFilters array by condition.
Array functionarray_index_ofReturns index of item in array.
Array functionarray_lengthReturns length of array.
Array functionarray_reverseReverses array elements.
Array functionarray_rotate_leftRotates array values to the left.
Array functionarray_rotate_rightRotates array values to the right.
Array functionarray_select_dictSelects dictionary from array of dictionaries.
Array functionarray_shift_leftShifts array values to the left.
Array functionarray_shift_rightShifts array values to the right.
Array functionarray_sliceReturns slice of an array.
Array functionarray_sort_ascSorts an array in ascending order.
Array functionarray_sort_descSorts an array in descending order.
Array functionarray_splitSplits array by indices.
Array functionarray_sumSums array elements.
Array functionbag_has_keyChecks if dynamic object has a specific key.
Array functionbag_keysReturns keys of a dynamic property bag.
Array functionbag_packCreates a dynamic property bag from key-value pairs.
Array functionbag_zipCombines two arrays of keys and values into a dynamic property bag.
Array functionisarrayChecks if value is an array.
Array functionlenReturns array or string length.
Array functionpack_arrayPacks input into a dynamic array.
Array functionpack_dictionaryReturns a dictionary from key-value mappings.
Array functionstrcat_arrayJoins array elements into a string using a delimiter.
Conditional functioncaseEvaluates conditions and returns the first matched result.
Conditional functioniffReturns one of two values based on predicate.
Conversion functiondynamic_to_jsonConverts dynamic value to JSON string.
Conversion functionensure_fieldReturns value of field or typed null.
Conversion functionisboolChecks if expression evaluates to boolean.
Conversion functiontoarrayConverts to array.
Conversion functiontoboolConverts to boolean.
Conversion functiontodatetimeConverts to datetime.
Conversion functiontodoubleConverts to real. todouble and toreal are synonyms.
Conversion functiontodynamicConverts to dynamic.
Conversion functiontohexConverts to hexadecimal string.
Conversion functiontointConverts to integer. toint and tolong are synonyms.
Conversion functiontolongConverts to signed 64-bit long. toint and tolong are synonyms.
Conversion functiontorealConverts to real. todouble and toreal are synonyms.
Conversion functiontostringConverts to string.
Conversion functiontotimespanConverts to timespan.
Datetime functionagoSubtracts timespan from current time.
Datetime functiondatetime_addAdds amount to datetime.
Datetime functiondatetime_diffDifference between two datetimes.
Datetime functiondatetime_partExtracts part of a datetime.
Datetime functiondayofmonthDay number in month.
Datetime functiondayofweekDays since previous Sunday.
Datetime functiondayofyearDay number in year.
Datetime functionendofdayReturns end of day.
Datetime functionendofmonthReturns end of month.
Datetime functionendofweekReturns end of week.
Datetime functionendofyearReturns end of year.
Datetime functiongetmonthMonth of a datetime.
Datetime functiongetyearYear of a datetime.
Datetime functionhourofdayHour number of the day.
Datetime functionmonthofyearMonth number of year.
Datetime functionnowReturns current UTC time.
Datetime functionstartofdayReturns start of day.
Datetime functionstartofmonthReturns start of month.
Datetime functionstartofweekReturns start of week.
Datetime functionstartofyearReturns start of year.
Datetime functionunixtime_microseconds_todatetimeConverts microsecond Unix timestamp to datetime.
Datetime functionunixtime_milliseconds_todatetimeConverts millisecond Unix timestamp to datetime.
Datetime functionunixtime_nanoseconds_todatetimeConverts nanosecond Unix timestamp to datetime.
Datetime functionunixtime_seconds_todatetimeConverts second Unix timestamp to datetime.
Datetime functionweek_of_yearReturns the ISO 8601 week number from a datetime expression.
GenAI functiongenai_concat_contentsConcatenates message contents from a GenAI conversation array.
GenAI functiongenai_conversation_turnsCounts the number of conversation turns in GenAI messages.
GenAI functiongenai_costCalculates the total cost for input and output tokens.
GenAI functiongenai_estimate_tokensEstimates the number of tokens in a text string.
GenAI functiongenai_extract_assistant_responseExtracts the assistant’s response from a GenAI conversation.
GenAI functiongenai_extract_function_resultsExtracts function call results from GenAI messages.
GenAI functiongenai_extract_system_promptExtracts the system prompt from a GenAI conversation.
GenAI functiongenai_extract_tool_callsExtracts tool calls from GenAI messages.
GenAI functiongenai_extract_user_promptExtracts the user prompt from a GenAI conversation.
GenAI functiongenai_get_content_by_indexGets message content by index position.
GenAI functiongenai_get_content_by_roleGets message content by role.
GenAI functiongenai_get_pricingGets pricing information for a specific AI model.
GenAI functiongenai_get_roleGets the role of a message at a specific index.
GenAI functiongenai_has_tool_callsChecks if GenAI messages contain tool calls.
GenAI functiongenai_input_costCalculates the cost for input tokens.
GenAI functiongenai_is_truncatedChecks if a GenAI response was truncated.
GenAI functiongenai_message_rolesExtracts all message roles from a GenAI conversation.
GenAI functiongenai_output_costCalculates the cost for output tokens.
Hash functionhash_md5Returns MD5 hash.
Hash functionhash_sha1Returns SHA-1 hash.
Hash functionhash_sha256Returns SHA256 hash.
Hash functionhash_sha512Returns SHA512 hash.
Hash functionhashReturns integer hash of input.
IP functionformat_ipv4_maskFormats IPv4 and mask to CIDR.
IP functionformat_ipv4Formats netmask into IPv4 string.
IP functiongeo_info_from_ip_addressExtracts geolocation from IP address.
IP functionhas_any_ipv4_prefixChecks if IPv4 starts with any prefix.
IP functionhas_any_ipv4Checks if any of given IPv4s exist in column.
IP functionhas_ipv4_prefixChecks if IPv4 starts with specified prefix.
IP functionhas_ipv4Checks if IPv4 is valid and in source text.
IP functionipv4_compareCompares two IPv4 addresses.
IP functionipv4_is_in_any_rangeChecks if IPv4 is in any specified range.
IP functionipv4_is_in_rangeChecks if IPv4 is in a given range.
IP functionipv4_is_matchMatches IPv4 against a pattern.
IP functionipv4_is_privateChecks if IPv4 is private.
IP functionipv4_netmask_suffixExtracts netmask suffix.
IP functionipv6_compareCompares two IPv6 addresses.
IP functionipv6_is_in_any_rangeChecks if IPv6 is in any range.
IP functionipv6_is_in_rangeChecks if IPv6 is in range.
IP functionipv6_is_matchChecks if IPv6 matches pattern.
IP functionparse_ipv4_maskConverts IPv4 and mask to long integer.
IP functionparse_ipv4Converts IPv4 to long integer.
Logical operator!=Returns true if either one (or both) of the operands are null, or they aren’t equal to each other. Otherwise, false.
Logical operator==Returns true if both operands are non-null and equal to each other. Otherwise, false.
Logical operatorandReturns true if both operands are true.
Logical operatororReturns true if one of the operands is true, regardless of the other operand.
Mathematical functionabsReturns absolute value.
Mathematical functionacosReturns arccosine of a number.
Mathematical functionasinReturns arcsine of a number.
Mathematical functionatanReturns arctangent of a number.
Mathematical functionatan2Returns angle between x-axis and point (y, x).
Mathematical functioncosReturns cosine of a number.
Mathematical functioncotReturns cotangent of a number.
Mathematical functiondegreesConverts radians to degrees.
Mathematical functionexpReturns e^x.
Mathematical functionexp10Returns 10^x.
Mathematical functionexp2Returns 2^x.
Mathematical functiongammaReturns gamma function of x.
Mathematical functionisfiniteReturns true if x is finite.
Mathematical functionisinfReturns true if x is infinite.
Mathematical functionisintReturns true if x is an integer.
Mathematical functionisnanReturns true if x is NaN.
Mathematical functionlogReturns natural logarithm of x.
Mathematical functionlog10Returns base-10 logarithm.
Mathematical functionlog2Returns base-2 logarithm.
Mathematical functionloggammaReturns log of absolute gamma function.
Mathematical functionmax_ofReturns largest value among arguments.
Mathematical functionmin_ofReturns smallest value among arguments.
Mathematical functionnotReverses boolean value.
Mathematical functionpiReturns value of Pi.
Mathematical functionpowReturns value raised to a power.
Mathematical functionradiansConverts degrees to radians.
Mathematical functionrandReturns pseudo-random numbers between 0 (inclusive) and 1 (exclusive).
Mathematical functionrangeReturns a dynamic array of evenly spaced values.
Mathematical functionroundRounds value to given precision.
Mathematical functionset_differenceReturns array difference.
Mathematical functionset_has_elementReturns true if set contains an element.
Mathematical functionset_intersectReturns array intersection.
Mathematical functionset_unionReturns array union.
Mathematical functionsignReturns sign of number.
Mathematical functionsinReturns sine of a number.
Mathematical functionsqrtReturns square root of a number.
Mathematical functiontanReturns tangent of a number.
Metadata functioncolumn_ifexistsChecks if a field with a given name exists in the dataset.
Metadata functioncursor_currentRetrieves a cursor string representing the current query execution point.
Metadata functioningestion_timeRetrieves the timestamp of when each record was ingested into Axiom.
Numerical operator-Subtract. Example: 0.26 - 0.23
Numerical operator!=Not equals. Example: 2 != 1
Numerical operator*Multiply. Example: 1s * 5, 5 * 5
Numerical operator/Divide. Example: 10m / 1s, 4 / 2
Numerical operator<Less. Example: 1 < 2, 1 <= 1
Numerical operator<=Less or Equal. Example: 5 <= 6
Numerical operator%Modulo. Example: 10 % 3, 5 % 2
Numerical operator+Add. Example: 3.19 + 3.19, ago(10m) + 10m
Numerical operator==Equals. Example: 3 == 3
Numerical operator>Greater. Example: 0.23 > 0.22, now() > ago(1d)
Numerical operator>=Greater or Equal. Example: 7 >= 6
Pair functionfind_pairSearches an array of key-value pairs for the first pair matching specified patterns.
Pair functionpairCreates a dynamic object representing a key-value pair.
Pair functionparse_pairParses a pair string into its key and value components.
Rounding functionbinRounds values down to an integer multiple of a specified bin size.
Rounding functionbin_autoRounds datetime values down to a fixed-size bin with automatic size selection.
Rounding functionceilingRounds a number up to the smallest integer greater than or equal to the input.
Rounding functionfloorRounds a number down to the largest integer less than or equal to the input.
Set membership operatorinEquals to one of the elements (case-sensitive). Example: "abc" in ("123", "345", "abc")
Set membership operatorin~Equals to one of the elements (case-insensitive). Example: "abc" in~ ("123", "345", "ABC")
Set membership operator!inNot equals to any of the elements (case-sensitive). Example: "bca" !in ("123", "345", "abc")
Set membership operator!in~Not equals to any of the elements (case-insensitive). Example: "bca" !in~ ("123", "345", "ABC")
SQL functionformat_sqlConverts parsed SQL data model back into SQL statement.
SQL functionparse_sqlParses and analyzes SQL queries.
String functionbase64_decode_toarrayDecodes a Base64-encoded string into an array of bytes.
String functionbase64_decode_tostringDecodes a base64 string to a UTF-8 string.
String functionbase64_encode_fromarrayConverts a sequence of bytes into a Base64-encoded string.
String functionbase64_encode_tostringEncodes a string as base64 string.
String functioncoalesceReturns the first non-null/non-empty value from a list.
String functioncountof_regexCounts occurrences of a regex in a string.
String functioncountofCounts occurrences of a substring in a string.
String functionextract_allGets all matches for a regular expression from a text string.
String functionextractGets a match for a regular expression from a text string.
String functionformat_bytesFormats a number of bytes as a string including units.
String functionformat_urlFormats a string into a valid URL.
String functiongettypeReturns the runtime type of an argument.
String functionindexofReturns index of the first occurrence of a substring.
String functionisasciiReturns true if all characters in an input string are ASCII characters.
String functionisemptyReturns true if the argument is empty or null.
String functionisnotemptyReturns true if the argument isn’t empty or null.
String functionisnotnullReturns true if the argument isn’t null.
String functionisnullReturns true if the argument is null.
String functionparse_bytesParses byte-size string to number of bytes.
String functionparse_csvSplits a CSV-formatted string into an array.
String functionparse_jsonParses a string as a JSON value.
String functionparse_urlParses a URL string and returns parts in a dynamic object.
String functionparse_urlqueryParses a URL query string into key-value pairs.
String functionquoteReturns a string representing the input enclosed in double quotes, with internal quotes and escape sequences handled appropriately.
String functionreplace_regexReplaces regex matches with another string.
String functionreplace_stringReplaces string matches with another string.
String functionreplaceReplaces all regex matches with another string.
String functionreverseReverses a string.
String functionsplitSplits a string into an array using a delimiter.
String functionstrcat_delimConcatenates 2–64 arguments with a delimiter.
String functionstrcatConcatenates 1–64 arguments.
String functionstrcmpCompares two strings.
String functionstring-sizeReturns the length, in characters, of the input string.
String functionstrip_ansi_escapesRemoves ANSI escape sequences from strings.
String functionstrlenReturns the length of a string.
String functionstrrepRepeats a string a given number of times.
String functionsubstringExtracts a substring.
String functiontolowerConverts string to lowercase.
String functiontotitleConverts string to title case.
String functiontoupperConverts string to uppercase.
String functiontranslateSubstitutes characters in a string, one by one, based on their position in two input lists.
String functiontrim_end_regexTrims trailing characters using regex.
String functiontrim_endTrims trailing characters.
String functiontrim_regexTrims characters matching a regex.
String functiontrim_spaceRemoves all leading and trailing whitespace from a string.
String functiontrim_start_regexTrims leading characters using regex.
String functiontrim_startTrims leading characters.
String functiontrimTrims leading/trailing characters.
String functionunicode_codepoints_from_stringConverts a UTF-8 string into an array of Unicode code points.
String functionunicode_codepoints_to_stringConverts an array of Unicode code points into a UTF-8 encoded string.
String functionurl_decodeDecodes a URL-encoded string.
String functionurl_encodeEncodes characters into a URL-friendly format.
String operator!=Not equals (case-sensitive). Example: "abc" != "ABC"
String operator!~Not equals (case-insensitive). Example: "aBc" !~ "xyz"
String operator!contains_csRHS doesn’t occur in LHS (case-sensitive). Example: "parentSpanId" !contains_cs "Id"
String operator!containsRHS doesn’t occur in LHS (case-insensitive). Example: "parentSpanId" !contains "abc"
String operator!endswith_csRHS isn’t a closing subsequence of LHS (case-sensitive). Example: "parentSpanId" !endswith_cs "Span"
String operator!endswithRHS isn’t a closing subsequence of LHS (case-insensitive). Example: "parentSpanId" !endswith "Span"
String operator!has_csRHS isn’t a whole term in LHS (case-sensitive). Example: "North America" !has_cs "America"
String operator!hasRHS isn’t a whole term in LHS (case-insensitive). Example: "North America" !has "america"
String operator!hasprefix_csLHS string doesn’t start with the RHS string (case-sensitive). Example: "DOCS_file" !hasprefix_cs "DOCS"
String operator!hasprefixLHS string doesn’t start with the RHS string (case-insensitive). Example: "Admin_User" !hasprefix "Admin"
String operator!hassuffix_csLHS string doesn’t end with the RHS string (case-sensitive). Example: "Document.HTML" !hassuffix_cs ".HTML"
String operator!hassuffixLHS string doesn’t end with the RHS string (case-insensitive). Example: "documentation.docx" !hassuffix ".docx"
String operator!matches regexLHS doesn’t contain a match for RHS. Example: "parentSpanId" !matches regex "g.*r"
String operator!startswith_csRHS isn’t an initial subsequence of LHS (case-sensitive). Example: "parentSpanId" !startswith_cs "parent"
String operator!startswithRHS isn’t an initial subsequence of LHS (case-insensitive). Example: "parentSpanId" !startswith "Id"
String operator==Equals (case-sensitive). Example: "aBc" == "aBc"
String operator=~Equals (case-insensitive). Example: "abc" =~ "ABC"
String operatorcontains_csRHS occurs as a subsequence of LHS (case-sensitive). Example: "parentSpanId" contains_cs "Id"
String operatorcontainsRHS occurs as a subsequence of LHS (case-insensitive). Example: "parentSpanId" contains "Span"
String operatorendswith_csRHS is a closing subsequence of LHS (case-sensitive). Example: "parentSpanId" endswith_cs "Id"
String operatorendswithRHS is a closing subsequence of LHS (case-insensitive). Example: "parentSpanId" endswith "Id"
String operatorhas_csRHS is a whole term in LHS (case-sensitive). Example: "North America" has_cs "America"
String operatorhasRHS is a whole term in LHS (case-insensitive). Example: "North America" has "america"
String operatorhas_anyRHS has any whole term in LHS (case-insensitive). Example: "North America" has_any ("america", "europe")
String operatorhas_any_csRHS has any whole term in LHS (case-sensitive). Example: "North America" has_any_cs ("America", "Europe")
String operatorhasprefix_csLHS string starts with the RHS string (case-sensitive). Example: "DOCS_file" hasprefix_cs "DOCS"
String operatorhasprefixLHS string starts with the RHS string (case-insensitive). Example: "Admin_User" hasprefix "Admin"
String operatorhassuffix_csLHS string ends with the RHS string (case-sensitive). Example: "Document.HTML" hassuffix_cs ".HTML"
String operatorhassuffixLHS string ends with the RHS string (case-insensitive). Example: "documentation.docx" hassuffix ".docx"
String operatormatches regexLHS contains a match for RHS. Example: "parentSpanId" matches regex "g.*r"
String operatorstartswith_csRHS is an initial subsequence of LHS (case-sensitive). Example: "parentSpanId" startswith_cs "parent"
String operatorstartswithRHS is an initial subsequence of LHS (case-insensitive). Example: "parentSpanId" startswith "parent"
Tabular operatorcountReturns an integer representing the total number of records in the dataset.
Tabular operatordistinctReturns a dataset with unique values from the specified fields, removing any duplicate entries.
Tabular operatorextend-validReturns a table where the specified fields are extended with new values based on the given expression for valid rows.
Tabular operatorextendReturns the original dataset with one or more new fields appended, based on the defined expressions.
Tabular operatorexternaldataReturns a table with the specified schema, containing data retrieved from an external source.
Tabular operatorgetschemaReturns the schema of the input, including field names and their data types.
Tabular operatorjoinReturns a dataset containing rows from two different tables based on conditions.
Tabular operatorlimitReturns the top N rows from the input dataset.
Tabular operatorlookupReturns a dataset where rows from one dataset are enriched with matching columns from a lookup table based on conditions.
Tabular operatormake-seriesReturns a dataset where the specified field is aggregated into a time series.
Tabular operatormv-expandReturns a dataset where the specified field is expanded into multiple rows.
Tabular operatororderReturns the input dataset, sorted according to the specified fields and order.
Tabular operatorparseReturns the input dataset with new fields added based on the specified parsing pattern.
Tabular operatorparse-kvReturns a dataset where key-value pairs are extracted from a string field into individual columns.
Tabular operatorparse-whereReturns a dataset where values from a string are extracted based on a pattern.
Tabular operatorproject-awayReturns the input dataset excluding the specified fields.
Tabular operatorproject-keepReturns a dataset with only the specified fields.
Tabular operatorproject-renameReturns a dataset where the specified field is renamed according to the specified pattern.
Tabular operatorproject-reorderReturns a table with the specified fields reordered as requested followed by any unspecified fields in their original order.
Tabular operatorprojectReturns a dataset containing only the specified fields.
Tabular operatorredactReturns the input dataset with sensitive data replaced or hashed.
Tabular operatorsampleReturns a table containing the specified number of rows, selected randomly from the input dataset.
Tabular operatorsearchReturns all rows where the specified keyword appears in any field.
Tabular operatorsortReturns a table with rows ordered based on the specified fields.
Tabular operatorsummarizeReturns a table where each row represents a unique combination of values from the by fields, with the aggregated results calculated for the other fields.
Tabular operatortakeReturns the specified number of rows from the dataset.
Tabular operatortopReturns the top N rows from the dataset based on the specified sorting criteria.
Tabular operatorunionReturns all rows from the specified tables or queries.
Tabular operatorwhereReturns a filtered dataset containing only the rows where the condition evaluates to true.
Time series functionseries_absReturns the absolute value of a series.
Time series functionseries_acosReturns the inverse cosine (arccos) of a series.
Time series functionseries_addPerforms element-wise addition between two series.
Time series functionseries_asinReturns the inverse sine (arcsin) of a series.
Time series functionseries_atanReturns the inverse tangent (arctan) of a series.
Time series functionseries_ceilingRounds each element up to the nearest integer.
Time series functionseries_cosReturns the cosine of a series.
Time series functionseries_cosine_similarityCalculates the cosine similarity between two series.
Time series functionseries_dividePerforms element-wise division between two series.
Time series functionseries_dot_productCalculates the dot product between two series.
Time series functionseries_equalsCompares each element in a series to a specified value and returns a boolean array.
Time series functionseries_expCalculates the exponential (e^x) of each element in a series.
Time series functionseries_fftPerforms a Fast Fourier Transform on a series, converting time-domain data into frequency-domain representation.
Time series functionseries_fill_backwardFills missing values by propagating the last known value backward through the array.
Time series functionseries_fill_constFills missing values with a specified constant value.
Time series functionseries_fill_forwardFills missing values by propagating the first known value forward through the array.
Time series functionseries_fill_linearFills missing values using linear interpolation between known values.
Time series functionseries_firApplies a Finite Impulse Response filter to a series using a specified filter kernel.
Time series functionseries_floorRounds down each element in a series to the nearest integer.
Time series functionseries_greaterReturns the elements of a series that are greater than a specified value.
Time series functionseries_greater_equalsReturns the elements of a series that are greater than or equal to a specified value.
Time series functionseries_ifftPerforms an Inverse Fast Fourier Transform on a series, converting frequency-domain data back into time-domain representation.
Time series functionseries_iirApplies an Infinite Impulse Response filter to a series.
Time series functionseries_lessReturns the elements of a series that are less than a specified value.
Time series functionseries_less_equalsReturns the elements of a series that are less than or equal to a specified value.
Time series functionseries_logReturns the natural logarithm of each element in a series.
Time series functionseries_magnitudeCalculates the Euclidean norm (magnitude) of a series.
Time series functionseries_maxReturns the maximum value from a series.
Time series functionseries_minReturns the minimum value from a series.
Time series functionseries_multiplyPerforms element-wise multiplication of two series.
Time series functionseries_not_equalsReturns the elements of a series that aren’t equal to a specified value.
Time series functionseries_pearson_correlationCalculates the Pearson correlation coefficient between two series.
Time series functionseries_powRaises each element in a series to a specified power.
Time series functionseries_signReturns the sign of each element in a series.
Time series functionseries_sinReturns the sine of a series.
Time series functionseries_statsComputes comprehensive statistical measures for a series.
Time series functionseries_stats_dynamicComputes statistical measures and returns them in a dynamic object format.
Time series functionseries_subtractPerforms element-wise subtraction between two series.
Time series functionseries_sumReturns the sum of a series.
Time series functionseries_tanReturns the tangent of a series.
Type functionisccChecks whether a value is a valid credit card (CC) number.
Type functionisimeiChecks whether a value is a valid International Mobile Equipment Identity (IMEI) number.
Type functionismapChecks whether a value is of the dynamic type and represents a mapping.
Type functionisrealChecks whether a value is a real number.
Type functionisstringChecks whether a value is a string.
Type functionisutf8Checks whether a value is a valid UTF-8 encoded sequence.
Was this page helpful?
Suggest edits on GitHub
PreviousSample queriesNextArray functions