{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"2"},"outline":{"value":"false"},"type":{"value":"flat"},"separator":{"value":"brackets"},"printable":{"value":"true"}},"macroMetadata":{"macroId":{"value":"04c00a42-8888-43ec-a1c1-62a0218c5429"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"ff3b4b8d-2490-4e78-ad51-82c7c2db38a6"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"About complex types","type":"text"}]},{"type":"paragraph","content":[{"text":"In Devo, complex data types provide flexible and powerful structures for querying and manipulatingdata logs. These types include ","type":"text"},{"text":"set","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"map","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"array","type":"text","marks":[{"type":"strong"}]},{"text":", and ","type":"text"},{"text":"tuple","type":"text","marks":[{"type":"strong"}]},{"text":", each with unique properties allowing users to efficiently handle diverse data operations. This article outlines the key characteristics and operations associated with each data type.","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"7da52d7e-fd77-49e1-8820-2fcd2e1223ab"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[307.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[360.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Set","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/978583650/Complex+data+types#Set"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[307.0]},"content":[{"type":"paragraph","content":[{"text":"Unordered, unique collection of values","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[360.0]},"content":[{"type":"paragraph","content":[{"text":"{1, 2, 3}","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/978583650/Complex+data+types#Map"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[307.0]},"content":[{"type":"paragraph","content":[{"text":"Key-value pairs, unique keys","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[360.0]},"content":[{"type":"paragraph","content":[{"text":"{\"a\": 1, \"b\": 2}","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Array","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/978583650/Complex+data+types#Array"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[307.0]},"content":[{"type":"paragraph","content":[{"text":"Ordered collection, allows duplicates","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[360.0]},"content":[{"type":"paragraph","content":[{"text":"[\"item1\", \"item2\", \"item3\"]","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Tuple","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/978583650/Complex+data+types#Tuple"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[307.0]},"content":[{"type":"paragraph","content":[{"text":"Ordered, immutable collection, mixed types","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[360.0]},"content":[{"type":"paragraph","content":[{"text":"(1.33, \"text\", true)","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"JSON","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/978583650/Complex+data+types#JSON"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[307.0]},"content":[{"type":"paragraph","content":[{"text":"Key-value pairs, unordered, unique keys, mixed types","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[360.0]},"content":[{"type":"paragraph","content":[{"text":"{\"a\": \"b\", \"c\": 1, \"d\" : [1,2,3], \"e\": {\"f\": 1}}","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"These complex data types provide the flexibility for handling structured and unstructured data in Devo, enabling efficient queries and operations across vast datasets. Users can effectively manipulate and analyze data within the Devo environment by leveraging sets, maps, arrays, and tuples.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The JSON type is not considered a complex type but it is included in this documentation for similarity purposes. Currently, it is not possible to cast JSON natively from/to a complex type.","type":"text"}]}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Set","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"A ","type":"text"},{"text":"set","type":"text","marks":[{"type":"strong"}]},{"text":" in Devo represents an unordered collection of ","type":"text"},{"text":"unique values","type":"text","marks":[{"type":"strong"}]},{"text":", meaning no duplicates are allowed. The order of elements in a set is not guaranteed, making it ideal for operations where uniqueness is more important than sequence.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"{1, 2, 3}","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Key Characteristics:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unordered","type":"text","marks":[{"type":"strong"}]},{"text":": Elements do not follow a specific order.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unique","type":"text","marks":[{"type":"strong"}]},{"text":": No duplicates are allowed.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Related operations","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"4e51ce3a-c2d1-480d-b8fc-97f43cb8d2cf"}}]},{"text":":","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"0f390ea0-6107-4be3-b211-13d22768a764"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"Operation","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Syntax","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Result Value","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"Result Type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"mkset or {}","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389152782"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"creates a set from elements","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"mkset (ele_1, ... ,ele_n)","type":"text"},{"type":"hardBreak"},{"text":"{ele_1, ... , ele_n}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"mkset (1.33,2,3,4)","type":"text"},{"type":"hardBreak"},{"text":"mkset (\"One\", \"two\", \"Number 3\")","type":"text"},{"type":"hardBreak"},{"text":"mkset (domain, responseTime)","type":"text"},{"type":"hardBreak"},{"text":"mkset (responseTime, srcPort)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"{1.33, 2, 3, 4}","type":"text"},{"type":"hardBreak"},{"text":"{One, two, Number 3}","type":"text"},{"type":"hardBreak"},{"text":"{One, 77}","type":"text"},{"type":"hardBreak"},{"text":"{self, 12}","type":"text"},{"type":"hardBreak"},{"text":"{12, 37406}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"set(float)","type":"text"},{"type":"hardBreak"},{"text":"set(str)","type":"text"},{"type":"hardBreak"},{"text":"set(str)","type":"text"},{"type":"hardBreak"},{"text":"set(str)","type":"text"},{"type":"hardBreak"},{"text":"set(int)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"isempty","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201054"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Checks if a set is empty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"isempty (set)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"isempty ({1, 2, 3})","type":"text"},{"type":"hardBreak"},{"text":"isempty ({ })","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"},{"type":"hardBreak"},{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"length","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201158"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the length of a set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"length (set)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"length ({1, 20, 3, 4, 20, 20})","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"4","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"has (->)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95200521"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Checks the occurrence of","type":"text"},{"type":"hardBreak"},{"text":"a specified value in a","type":"text"},{"type":"hardBreak"},{"text":"given set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"has (set, ele)","type":"text"},{"type":"hardBreak"},{"text":"set -> ele","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"has ({31, 2, 77}, 77)","type":"text"},{"type":"hardBreak"},{"text":"{31, 2, 77} -> 77","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"},{"type":"hardBreak"},{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"in (<-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201087"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Checks the occurrence of","type":"text"},{"type":"hardBreak"},{"text":"a specified value in a","type":"text"},{"type":"hardBreak"},{"text":"given set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"`in` (ele, set)","type":"text"},{"type":"hardBreak"},{"text":"ele <- set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"`in` (77, {30, 2, 77})","type":"text"},{"type":"hardBreak"},{"text":" 77 <- {30, 2, 77}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"},{"type":"hardBreak"},{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"has (->)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95200521"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Checks whether a set","type":"text"},{"type":"hardBreak"},{"text":"contains another set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"has (set_1, set_2)","type":"text"},{"type":"hardBreak"},{"text":"set_1 -> set_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":" has ({1, 2 , 3, 4}, {2, 1})","type":"text"},{"type":"hardBreak"},{"text":" {1, 2 , 3, 4} -> {2, 1}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"},{"type":"hardBreak"},{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"in (<-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201087"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Checks whether a set","type":"text"},{"type":"hardBreak"},{"text":"contains another set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"`in` (set_1, set_2)","type":"text"},{"type":"hardBreak"},{"text":"set_1 <- set_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"`in` ({1, 2 , 3, 4}, {2, 1})","type":"text"},{"type":"hardBreak"},{"text":" {1, 2 , 3, 4} <- {2, 1}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"},{"type":"hardBreak"},{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"add (+)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193212"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Adds some value to a set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"add (set, ele)","type":"text"},{"type":"hardBreak"},{"text":"add (ele, set)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"add ({30, \"Peter\", 77}, “Ann\")","type":"text"},{"type":"hardBreak"},{"text":" {30, \"Peter\", 77} + “Ann\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"{30, Peter, 77, Ann}","type":"text"},{"type":"hardBreak"},{"text":"{30, Peter, 77, Ann}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"set(str)","type":"text"},{"type":"hardBreak"},{"text":"set(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"add (+)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193212"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Union of two sets","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"add (set_1, set_2)","type":"text"},{"type":"hardBreak"},{"text":" set_1 + set_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"add ({5, \"Peter\", 77}, {77, \"Ann\", 400})","type":"text"},{"type":"hardBreak"},{"text":" {5, \"Peter\", 77} + {77, \"Ann\", 400}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"{5, Peter, 77, Ann, 400]","type":"text"},{"type":"hardBreak"},{"text":"{5, Peter, 77, Ann, 400]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"set(str)","type":"text"},{"type":"hardBreak"},{"text":"set(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"join *","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/388923425"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Joins the strings of a given","type":"text"},{"type":"hardBreak"},{"text":"set in a single string","type":"text"},{"type":"hardBreak"},{"text":"(separataror can be added)","type":"text"},{"type":"hardBreak"},{"text":"NOTE : no order granted","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"join (set_str)","type":"text"},{"type":"hardBreak"},{"text":"join (set_str, sep)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"join ({1, \"Peter\", 77, 77, \"Ann\"})","type":"text"},{"type":"hardBreak"},{"text":"join ({1, \"Peter\", 77, 77, \"Ann\"} , \"_x_\")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"1Ann77Peter","type":"text"},{"type":"hardBreak"},{"text":"1_x_Ann_x_77_x_Peter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"band","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95198338"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Intersection of two sets","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"band (set_1, set_2)","type":"text"},{"type":"hardBreak"},{"text":" set_1 & set_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"band ({30, 2, 77}, {77, 400})","type":"text"},{"type":"hardBreak"},{"text":"band ({30, 2, 77}, {500, 400})","type":"text"},{"type":"hardBreak"},{"text":" {30, 2, 77} & {77, 400}","type":"text"},{"type":"hardBreak"},{"text":" {30, 2, 77} & {500, 400}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"{77}","type":"text"},{"type":"hardBreak"},{"text":"{}","type":"text"},{"type":"hardBreak"},{"text":"{77}","type":"text"},{"type":"hardBreak"},{"text":"{}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"set(int)","type":"text"},{"type":"hardBreak"},{"text":"set(int)","type":"text"},{"type":"hardBreak"},{"text":"set(int)","type":"text"},{"type":"hardBreak"},{"text":"set(int)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"sub (-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193656"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Deletes a value from a set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"sub (set, ele)","type":"text"},{"type":"hardBreak"},{"text":"set - ele","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"sub ({30, 2, 77}, 400)","type":"text"},{"type":"hardBreak"},{"text":" {30, 2, 77} - 400","type":"text"},{"type":"hardBreak"},{"text":"sub ({30, \"Peter\", 77}, \"Peter\")","type":"text"},{"type":"hardBreak"},{"text":" {30, \"Peter\", 77} - \"Peter\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"{30, 2, 77}","type":"text"},{"type":"hardBreak"},{"text":"{30, 2, 77}","type":"text"},{"type":"hardBreak"},{"text":"{30, 77}","type":"text"},{"type":"hardBreak"},{"text":"{30, 77}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"•set(int)","type":"text"},{"type":"hardBreak"},{"text":"•set(int)","type":"text"},{"type":"hardBreak"},{"text":"•set(str)","type":"text"},{"type":"hardBreak"},{"text":"•set(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"sub (-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193656"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Difference of two sets","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"sub (set_1, set_2)","type":"text"},{"type":"hardBreak"},{"text":" set_1 – set_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"sub ({30, 2, 77}, {400, 30})","type":"text"},{"type":"hardBreak"},{"text":" {30, 2, 77} - 400","type":"text"},{"type":"hardBreak"},{"text":"sub ({30, \"Peter\", 77}, {\"Peter\", 30})","type":"text"},{"type":"hardBreak"},{"text":" {30, \"Peter\", 77} - {\"Peter\", 30}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"{2, 77}","type":"text"},{"type":"hardBreak"},{"text":"{2, 77}","type":"text"},{"type":"hardBreak"},{"text":"{77}","type":"text"},{"type":"hardBreak"},{"text":"{77}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"set(int)","type":"text"},{"type":"hardBreak"},{"text":"set(int)","type":"text"},{"type":"hardBreak"},{"text":"set(str)","type":"text"},{"type":"hardBreak"},{"text":"set(str)","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Common Operations:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"from siem.logtrust.web.activity","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a set","type":"text","marks":[{"type":"strong"}]},{"text":" from values:","type":"text"}]},{"type":"codeBlock","content":[{"text":"select mkset(srcHost, params) as mkset_string","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Convert an array to a set","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select set([1, 2, 2, 3]) as toset_int_1_2_3","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check if a set contains a specific value","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select toset_int -> 2 as has","type":"text"}]},{"type":"codeBlock","content":[{"text":"select 2 in toset_int_1_2_3 as _in","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add values to a set","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select \"new value\" + mkset_string as add_va","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Get distinct values in a set out of a grouped field","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"select join(mkset_string, \",\") as join_set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Get distinct values in a set out of a grouped field","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"group select collectdistinct(responseLength) as responseLength_sizedistinct","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Test them together in Data Search","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sql"},"content":[{"text":"from siem.logtrust.web.activity\n//create a set\n select mkset(srcHost,params) as mkset_string\n select {srcHost, params}\n//convert an into a set\n select [1,2,3] as array,\n set(array) as toset_int,\n//check if the set is empty\n isempty(mkset_string) as isemty,\n//what is the length of the array\n length(mkset_string) as length,\n//does the set contain a specific item?\n toset_int -> 2 as has,\n//add values to a set\n \"new value\" + mkset_string as add_va,\n//join a set. Concatenates all the values of a set\n join(mkset_string, \",\") as join_set\n//Get distinct values in a set out of a grouped field\n //group select collectdistinct(responseLength) as responseLength_sizedistinct","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Map","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"A ","type":"text"},{"text":"map","type":"text","marks":[{"type":"strong"}]},{"text":" in Devo is a collection of ","type":"text"},{"text":"key-value pairs","type":"text","marks":[{"type":"strong"}]},{"text":" where each key is unique, but values can be duplicated. Maps allow for efficient lookups by keys and are useful when working with datasets that need to associate properties or attributes to specific items.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"{\"src\": srcPort, \"serverPort\": serverPort}","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Key Characteristics:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Key-Value Structure","type":"text","marks":[{"type":"strong"}]},{"text":": Each pair associates a key with a value.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unique Keys","type":"text","marks":[{"type":"strong"}]},{"text":": Each key must be unique, though values can repeat.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Related operations:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"3ebae777-8a85-47c5-ab21-d09de834f07c"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"Operation","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"Syntax","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"Result Value","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"Result Type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"mkmap or { : }","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/388169736"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Creates a map from","type":"text"},{"type":"hardBreak"},{"text":"keys and values","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"mkmap (key_1, val_1, ... , key_n, val_n)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"mkmap (10, 1001, 20, 1.33)","type":"text"},{"type":"hardBreak"},{"text":"mkmap (10, 1001, 20, \"Yesterday\")","type":"text"},{"type":"hardBreak"},{"text":"mkmap (\"One\", 100, \"Two\", 200)","type":"text"},{"type":"hardBreak"},{"text":" { 1 : \"Hello\", 2 : \"Bye\" }","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{10:1001, 20:1.33}","type":"text"},{"type":"hardBreak"},{"text":"{10=1001, 20=Yesterday}","type":"text"},{"type":"hardBreak"},{"text":"{One=100, Two=200}","type":"text"},{"type":"hardBreak"},{"text":"{1=Hello, 2=Bye}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, float)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(str, int)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"collectdistinct()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/446234632"}}]},{"text":" (aggr)","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Creates a map of distinct values after an aggregation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"collectdistinct(aggr_field)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"codeBlock","content":[{"text":"from siem.logtrust.web.activity\nselect {1, 20, 3, 4, 20, 20} as map\ngroup\nselect collectdistinct(map)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{{1, 3, 20, 4}}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, int,int,int)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"isempty","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201054"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Checks if a map is empty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"isempty (map)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"isempty ({1:10, 2:20, 3:30})","type":"text"},{"type":"hardBreak"},{"text":"isempty ({})","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"},{"type":"hardBreak"},{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"length","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201158"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the length of a","type":"text"}]},{"type":"paragraph","content":[{"text":"map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"length (map)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"length ({1:\"a\", 2:\"b\", 3:\"c\"})","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"has (->)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95200521"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Checks the","type":"text"},{"type":"hardBreak"},{"text":"occurrence of a","type":"text"},{"type":"hardBreak"},{"text":"specified key in a","type":"text"},{"type":"hardBreak"},{"text":"given map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"has (map, key)","type":"text"},{"type":"hardBreak"},{"text":"map -> key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"has ({1:\"aaa\", 2:\"bbb\", 77:\"ccc\"}, 77)","type":"text"},{"type":"hardBreak"},{"text":" {1:\"aaa\", 2:\"bbb\", 77:\"ccc\"} -> 77","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"},{"type":"hardBreak"},{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"in (<-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201087"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Checks the","type":"text"},{"type":"hardBreak"},{"text":"occurrence of a","type":"text"},{"type":"hardBreak"},{"text":"specified key in a","type":"text"},{"type":"hardBreak"},{"text":"given map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"`in` (key, map)","type":"text"},{"type":"hardBreak"},{"text":"key <- map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"`in` (77, {1:\"aaa\", 2:\"bbb\", 77:\"ccc\"})","type":"text"},{"type":"hardBreak"},{"text":" 77 <- {1:\"aaa\", 2:\"bbb\", 77:\"ccc\"}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"},{"type":"hardBreak"},{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"add (+)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193212"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Adds some key-value","type":"text"},{"type":"hardBreak"},{"text":"pair to a map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"add (map, key, value)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"add ({5:“Peter\", 10:“Ann\"}, 4, “xxx\")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{5=Peter, 10=Ann, 4=xxx}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"add (+)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193212"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Concatenation of two","type":"text"},{"type":"hardBreak"},{"text":"maps","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"add (map_1, map_2)","type":"text"},{"type":"hardBreak"},{"text":" map_1 + map_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"add ({5:\"Peter\", 10:\"Ann\"}, {4:\"xxx\"})","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Peter\", 10:\"Ann\"} + {4:\"xxx\"}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{5=Peter, 10=Ann, 4=xxx}","type":"text"},{"type":"hardBreak"},{"text":"{5=Peter, 10=Ann, 4=xxx}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"at [ ]","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389152771"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Given a map, returns the","type":"text"},{"type":"hardBreak"},{"text":"value associated to a","type":"text"},{"type":"hardBreak"},{"text":"given key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"at (map, key)","type":"text"},{"type":"hardBreak"},{"text":" map [key]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"at ({\"Hello\":77, 4:4000}, \"Hello\")","type":"text"},{"type":"hardBreak"},{"text":" {\"Hello\":77, 4:4000} [\"Hello\"]","type":"text"},{"type":"hardBreak"},{"text":"at ({1:\"One\", 2:\"Two\"}, 888)","type":"text"},{"type":"hardBreak"},{"text":" {1:\"One\", 2:\"Two\"} [888]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"77","type":"text"},{"type":"hardBreak"},{"text":"77","type":"text"},{"type":"hardBreak"},{"text":"null","type":"text"},{"type":"hardBreak"},{"text":"null","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text"},{"type":"hardBreak"},{"text":"int","type":"text"},{"type":"hardBreak"},{"text":"str","type":"text"},{"type":"hardBreak"},{"text":"str","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"band","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95198338"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Intersection of two maps :","type":"text"},{"type":"hardBreak"},{"text":"•Non-commutative","type":"text"},{"type":"hardBreak"},{"text":"•Intersection by key","type":"text"},{"type":"hardBreak"},{"text":"•Returns first map value","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"band (map_1, map_2)","type":"text"},{"type":"hardBreak"},{"text":" map_1 & map_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"band ({5:\"Five\", 2:\"Two\"}, {2:\"xxx\"})","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Five\", 2:\"Two\"} & {2:\"xxx\"}","type":"text"},{"type":"hardBreak"},{"text":"band ({5:\"Five\", 2:\"Two\"}, {6:“Six\"})","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Five\", 2:\"Two\"} & {6:“Six\"}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{2=Two}","type":"text"},{"type":"hardBreak"},{"text":"{2=Two}","type":"text"},{"type":"hardBreak"},{"text":"{}","type":"text"},{"type":"hardBreak"},{"text":"{}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"band","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95198338"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Restrict a map to a set of","type":"text"},{"type":"hardBreak"},{"text":"keys","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"band (map, set)","type":"text"},{"type":"hardBreak"},{"text":" map & set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"band ({5:\"Five\", 2:\"Two\", 6:\"Six\"}, {6, 2})","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Five\", 2:\"Two\", 6:\"Six\"} & {6, 2}","type":"text"},{"type":"hardBreak"},{"text":"band ({5:\"Five\", 2:\"Two\"}, {10, 20})","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Five\", 2:\"Two\"} & {10, 20}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{2=Two, 6=Six}","type":"text"},{"type":"hardBreak"},{"text":"{2=Two, 6=Six}","type":"text"},{"type":"hardBreak"},{"text":"{}","type":"text"},{"type":"hardBreak"},{"text":"{}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"sub (-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193656"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Deletes the key-value pair","type":"text"},{"type":"hardBreak"},{"text":"defined by a key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"sub (map, key)","type":"text"},{"type":"hardBreak"},{"text":" map - key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"sub ({5:\"Five\", 2:\"Two\", 6:\"Six\"}, 5)","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Five\", 2:\"Two\", 6:\"Six\"} - 5}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{2:“Two\", 6:“Six\"}","type":"text"},{"type":"hardBreak"},{"text":"{2:“Two\", 6:“Six\"}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"sub (-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193656"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Deletes the key-value pairs","type":"text"},{"type":"hardBreak"},{"text":"defined by a set of keys","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"sub (map, set)","type":"text"},{"type":"hardBreak"},{"text":" map – set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"sub ({5:\"Five\", 2:\"Two\", 6:\"Six\"}, {2, 5, 10})","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Five\", 2:\"Two\", 6:\"Six\"} - {2, 5, 10}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{6=Six}","type":"text"},{"type":"hardBreak"},{"text":"{6=Six}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"sub (-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193656"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Difference of two maps","type":"text"},{"type":"hardBreak"},{"text":"(difference by key)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"sub (map_1, map_2)","type":"text"},{"type":"hardBreak"},{"text":" map_2 – map_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"sub ({5:\"Five\", 2:\"Two\", 6:\"Six\"} {5:“xxx\"})","type":"text"},{"type":"hardBreak"},{"text":" {5:\"Five\", 2:\"Two\", 6:\"Six\"}- {5:“xxx\"}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{2:“Two\", 6:“Six\"}","type":"text"},{"type":"hardBreak"},{"text":"{2:“Two\", 6:“Six\"}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"map(int, str)","type":"text"},{"type":"hardBreak"},{"text":"map(int, str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"keys","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/388825112"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the set of keys of a given map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"keys (map)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"keys ({\"Hello\":77, 4:4000})","type":"text"},{"type":"hardBreak"},{"text":"keys ({99:\"Monday\", 4:4000})","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"{Hello, 4}","type":"text"},{"type":"hardBreak"},{"text":"{99, 4}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"set(str)","type":"text"},{"type":"hardBreak"},{"text":"set(int)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"values","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389251087"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[129.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the array of values of a given map","type":"text"},{"type":"hardBreak"},{"text":"NOTE : no order granted","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"values (map)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"values ({\"Hello\":77, 4:4000})","type":"text"},{"type":"hardBreak"},{"text":"values ({99:\"Monday\", 4:4000})","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","content":[{"text":"[77, 4000]","type":"text"},{"type":"hardBreak"},{"text":"[4000, Monday]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[105.0]},"content":[{"type":"paragraph","content":[{"text":"array(int)","type":"text"},{"type":"hardBreak"},{"text":"array(str)","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Common Operations:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a map","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select mkmap(\"b\",7,\"c\",6,\"a\",5) as map1","type":"text"}]},{"type":"codeBlock","content":[{"text":"select mkmap(\"src\", srcPort, \"serverPort\", serverPort) as map2","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check if a map is empty","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select isempty(map1) as is_empty","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Get the length of a map","type":"text","marks":[{"type":"strong"}]},{"text":" (number of key-value pairs):","type":"text"}]},{"type":"codeBlock","content":[{"text":"select length(map1) as map_length","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access a value by key","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select map1 -> \"b\" as src_value","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Append new key-value pairs","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select map1 + map2 as map3","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Subtract pairs","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"select map3 - map2 as _substract_pairs","type":"text"}]},{"type":"codeBlock","content":[{"text":"select map3 - \"b\" as _substract_key_b","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Return the value of a give key","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"select map3[\"b\"] as _return_7","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Return all keys or values","type":"text","marks":[{"type":"strong"}]},{"text":" from a map:","type":"text"}]},{"type":"codeBlock","content":[{"text":"select keys(map3) as _keys_set","type":"text"}]},{"type":"codeBlock","content":[{"text":"select values(map3) as _values_array","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Test them together in Data Search","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sql"},"content":[{"text":"from siem.logtrust.web.activity\n//create a map\n select mkmap(\"b\",7,\"c\",6,\"a\",5) as map1\n select {\"src\":srcPort, \"serverPort\": serverPort} as map2\n//Checks if a map is empty\n select isempty(map1) as _false\n//Returns the length of a map\n select length(map1) as _length\n//check the occurrence of key \"b\"?\n select map1 -> \"b\" as _true\n//append of new pairs\n select map1 + map2 as map3\n//subtract pairs\n select map3 - map2 as _substract_pairs\n select map3 - \"b\" as _substract_key_b\n//return the value of a give key\n select map3[\"b\"] as _return_7\n//return all the keys or values of a map\n select keys(map3) as _keys_set\n select values(map3) as _values_array","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Array","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"An ","type":"text"},{"text":"array","type":"text","marks":[{"type":"strong"}]},{"text":" is an ordered collection of elements where duplicates are allowed. Arrays are especially useful for performing a range of operations such as sorting, summing, and filtering. Unlike sets, arrays preserve the order of elements, making them essential for ordered data manipulation.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"[\"usernameJohn\", \"usernameMary\", \"usernameJoe\", \"usernameJane\"]","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Key Characteristics:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ordered","type":"text","marks":[{"type":"strong"}]},{"text":": Elements follow a specific sequence.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allows Duplicates","type":"text","marks":[{"type":"strong"}]},{"text":": Identical elements can appear multiple times.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Related operations:","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"eaa12b7c-0ade-42a6-90a0-6e52a49fc3e6"}}]}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"c62e9655-1e2b-403b-9809-4ad21ad14b5f"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Operation","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"Syntax","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"Result Value","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f6f6f6","rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Result Type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"mkarray or []","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/386891796"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Creates an array from elements","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"mkarray (ele_1, … ,ele_n)","type":"text"},{"type":"hardBreak"},{"text":"[ele_1, … , ele_n]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"mkarray (1.33,2,3,4) mkarray (“One\", \"two\", \"Number 3“) ","type":"text"}]},{"type":"paragraph","content":[{"text":"[ “One\", 77 ]","type":"text"}]},{"type":"paragraph","content":[{"text":"mkarray (domain, responseTime)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[1.33, 2, 3, 4]","type":"text"},{"type":"hardBreak"},{"text":"[One, two, Number 3]","type":"text"},{"type":"hardBreak"},{"text":"[One, 77] [self, 12]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array(float) array(str) array(str) array(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"split","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201437"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Creates an array by splitting a string field","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"split (string, string)","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"6cd8e526-33cf-4953-9786-ec93c3aa9b52"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"split(\"1.2.3.4\", \".\")","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[1, 2, 3, 4]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"isempty","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201054"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Checks if an array is empty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"isempty (array)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"isempty ([1, 2, 3]) isempty ([ ])","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"false true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"length","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201158"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the length of an array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"length (array)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"length ([1, 2, 3, 4, 5, 6])","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"6","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Int","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"has (->)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95200521"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Checks the occurrence of a specified value in a given array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"•has (array, ele) •array -> ele","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"has ([30, 2, 77], 77)","type":"text"}]},{"type":"paragraph","content":[{"text":"[30, 2, 77] -> 77","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]},{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"in (<-)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201087"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Checks the occurrence of a specified value in a given array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"`in` (ele, array) ele <- array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"`in` (77, [30, 2, 77]) ","type":"text"}]},{"type":"paragraph","content":[{"text":"77 <- [30, 2, 77]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]},{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"add (+)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193212"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Appends some value to the end of an array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"add (array, ele)","type":"text"},{"type":"hardBreak"},{"text":"array + ele","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"add ([30, \"Peter\", 77], \"Ann\")","type":"text"},{"type":"hardBreak"},{"text":" [30, \"Peter\", 77] + \"Ann\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[30, Peter, 77, Ann]","type":"text"},{"type":"hardBreak"},{"text":"[30, Peter, 77, Ann]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array(str)","type":"text"},{"type":"hardBreak"},{"text":"array(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"add (+)","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193212"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Concatenates two arrays","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"add (array_1, array_2)","type":"text"},{"type":"hardBreak"},{"text":"array_1 + array_2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"add ([5, \"Peter\", 77], [77, \"Ann\", 400])","type":"text"},{"type":"hardBreak"},{"text":"[5, \"Peter\", 77] + [77, \"Ann\", 400]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[5, Peter, 77, 77, Ann, 400]","type":"text"},{"type":"hardBreak"},{"text":"[5, Peter, 77, 77, Ann, 400]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array(str)","type":"text"},{"type":"hardBreak"},{"text":"array(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"join","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/388923425"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Joins the strings of a given","type":"text"},{"type":"hardBreak"},{"text":"array in a single string","type":"text"},{"type":"hardBreak"},{"text":"(separataror can be added)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"join (array_str)","type":"text"},{"type":"hardBreak"},{"text":"join (array_str, sep)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"join ([1, \"Peter\", 77, 77, \"Ann\"])","type":"text"},{"type":"hardBreak"},{"text":"join ([1, \"Peter\", 77, 77, \"Ann\"], “_x_”)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"1Peter7777Ann","type":"text"},{"type":"hardBreak"},{"text":"1_x_Peter_x_77_x_77_x_Ann","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"at or [][]","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389152771"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the n-th element of","type":"text"},{"type":"hardBreak"},{"text":"an array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"at (array, n)","type":"text"},{"type":"hardBreak"},{"text":"array [n]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"at ([10, 20, 3.33, 40], 1)","type":"text"},{"type":"hardBreak"},{"text":"[10, 20, 3.33, 40] [2]","type":"text"},{"type":"hardBreak"},{"text":"at ([10, 20, 3.33, \"HELLO\"], 3)","type":"text"},{"type":"hardBreak"},{"text":"at ([10, 20, 333, 40], 777)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"20","type":"text"},{"type":"hardBreak"},{"text":"3.33","type":"text"},{"type":"hardBreak"},{"text":"HELLO","type":"text"},{"type":"hardBreak"},{"text":"null","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"float","type":"text"},{"type":"hardBreak"},{"text":"float","type":"text"},{"type":"hardBreak"},{"text":"str","type":"text"},{"type":"hardBreak"},{"text":"int","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"at or [][]","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389152771"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Returns a subarray between","type":"text"},{"type":"hardBreak"},{"text":"two indices","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"at (array, from, to)","type":"text"},{"type":"hardBreak"},{"text":"array [from, to]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"at ([10, 20, 30, 40], 1, 3)","type":"text"},{"type":"hardBreak"},{"text":" [\"A\", \"B\", \"C\", \"D\"] [1, 3]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[20, 30]","type":"text"},{"type":"hardBreak"},{"text":"[\"B\", \"C\"]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array(int)","type":"text"},{"type":"hardBreak"},{"text":"array(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"indexof","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/388890626"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the index of the first","type":"text"},{"type":"hardBreak"},{"text":"appearance of a value in","type":"text"},{"type":"hardBreak"},{"text":"an array (-1 if not present)","type":"text"},{"type":"hardBreak"},{"text":"starting at 0","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"indexof (array, ele)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"indexof ([10, 20, 3.33, 40], 3.33)","type":"text"},{"type":"hardBreak"},{"text":"indexof ([10, 20, 333, 40], 777)","type":"text"},{"type":"hardBreak"},{"text":"indexof ([\"Hello\", \"my friend\"],\"Hello\")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"2","type":"text"},{"type":"hardBreak"},{"text":"-1","type":"text"},{"type":"hardBreak"},{"text":"0","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"dropnulls","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/388923414"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Drops null elements of a given array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"dropnulls (array)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"dropnulls ([3, null, 77, null])","type":"text"},{"type":"hardBreak"},{"text":"dropnulls ([3, null, \"HELLO\", null])","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[3, 77]","type":"text"},{"type":"hardBreak"},{"text":"[3, HELLO]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array(int)","type":"text"},{"type":"hardBreak"},{"text":"array(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"sort","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389120003"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Sorts the elements of a","type":"text"},{"type":"hardBreak"},{"text":"given array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"sort (array)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"sort ([3, 77, 30, 1)","type":"text"},{"type":"hardBreak"},{"text":"sort ([\"AAA\", \"aaa\", \"44\", 5])","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[1, 3, 30, 77]","type":"text"},{"type":"hardBreak"},{"text":"[44, 5, AAA, aaa]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array(int)","type":"text"},{"type":"hardBreak"},{"text":"array(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"reverse","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201362"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Reverses the elements of","type":"text"},{"type":"hardBreak"},{"text":"a given array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"reverse","type":"text"},{"type":"hardBreak"},{"text":"(array)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"reverse ([3, 77, 30, 1)","type":"text"},{"type":"hardBreak"},{"text":"reverse ([\"AAA\", \"aaa\", \"44\", 5])","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"[1, 30, 77, 3]","type":"text"},{"type":"hardBreak"},{"text":"[5, 44, aaa, AAA]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"array(int)","type":"text"},{"type":"hardBreak"},{"text":"array(str)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"sum","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95193032"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","content":[{"text":"Sums the values of a","type":"text"},{"type":"hardBreak"},{"text":"numeric array","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"sum (array)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"sum([1,2,3,4])","type":"text"},{"type":"hardBreak"},{"text":"sum([1,2,3.5,4.5])","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[116.0]},"content":[{"type":"paragraph","content":[{"text":"10","type":"text"},{"type":"hardBreak"},{"text":"11","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Int","type":"text"},{"type":"hardBreak"},{"text":"float","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Common Operations:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create an array","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select mkarray(username, ip4(srcHost), mm2coordinates(ip4(srcHost)), true) as array1\nselect [\"hi\", \"i_am_in_a_set\"] as array2","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Convert a set to an array","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select {serverPort, srcPort} as set1","type":"text"}]},{"type":"codeBlock","content":[{"text":"select array(set1) as array3","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check if an array contains a value","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select \"hi\" in array2","type":"text"}]},{"type":"codeBlock","content":[{"text":"select array2 -> \"hi\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add a value to an array","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select array2 + \"example\" as array_with_example","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Reverse an array","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select reverse(array2) as array_reversed","type":"text"}]},{"type":"codeBlock","content":[{"text":"select reverse(\"hello\") as _treat_strings_as_arrays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Drop null values","type":"text","marks":[{"type":"strong"}]},{"text":" from an array:","type":"text"}]},{"type":"codeBlock","content":[{"text":"select dropnulls(array2) as array_without_nulls","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Sum numeric arrays","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select sum([1,5,8]) as array_sum","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"length of an array","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"select length(array2)","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Test them together in Data Search","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sql"},"content":[{"text":"from siem.logtrust.web.activity\n//create an array\n select mkarray(username, ip4(srcHost), mm2coordinates(ip4(srcHost)), true) as array1\n select [\"hi\", \"i_am_in_a_set\"] as array2\n//convert a set to an array\n select {serverPort, srcPort} as set1\n select array(set1) as array3\n//filter or check the occurrance of a value in an array\n select \"hi\" in array2\n select array2 -> \"hi\"\n//length of an array\n select length(array2)\n//add a value\n select array2 + \"example\" as array_with_example\n//drop nulls\n select dropnulls(array2) as array_without_nulls\n//reverse an array\n select reverse(array2) as array_reversed\n select reverse(\"hello\") as _treat_strings_as_arrays\n//sum numeric arrays\n select sum([1,5,8]) as _14","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Tuple","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"A ","type":"text"},{"text":"tuple","type":"text","marks":[{"type":"strong"}]},{"text":" in Devo is an ordered collection of elements that can be of mixed types (e.g., strings, numbers, booleans). Unlike arrays, tuples maintain the individual types of each element and are ","type":"text"},{"text":"immutable","type":"text","marks":[{"type":"strong"}]},{"text":", meaning that once created, the elements cannot be changed.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"(1.33, \"text\", true)","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Key Characteristics:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ordered","type":"text","marks":[{"type":"strong"}]},{"text":": Elements are stored in a specific sequence.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Immutable","type":"text","marks":[{"type":"strong"}]},{"text":": The values in a tuple cannot be modified after creation.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allows Duplicates","type":"text","marks":[{"type":"strong"}]},{"text":": Identical elements can appear more than once.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allows Mixed Types","type":"text","marks":[{"type":"strong"}]},{"text":": Elements can be of any type (e.g., string, integer, boolean).","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Related operations: ","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"163da346-9fc1-4f4f-92ef-001057c7e463"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Operation","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"Syntax","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Result Value","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"Result Type","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"mktuple","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/617119745"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Creates a tuple with specified elements.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"mktuple(elem_1, elem_2, ..., elem_n)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"mktuple(username, ip4(srcHost), mm2coordinates(ip4(srcHost)), true)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"(username, ip4, coordinates, true)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"tuple(varied types)","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Tuple literal","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Creates a tuple using parentheses.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"(elem_1, elem_2, ..., elem_n)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"(username, srcPort, ip4(srcHost), true)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"(username, srcPort, ip4, true)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"tuple(varied types)","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Access by index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Access tuple elements using index. Supports negative indexing.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"tuple[index]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"tuple[0]","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"tuple[-1]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"First element","type":"text"}]},{"type":"paragraph","content":[{"text":"Last element","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"Matches element type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"at()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389152771"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Access tuple elements by index using a function.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"at(tuple, index)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"at(tuple, 0)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"First element","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"Matches element type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Filter by type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Filters tuple elements based on data type or pattern.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"where tuple[index] -> type","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"where tuple[0] -> \"@\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Matches filtered criteria","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Filter by value","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Filters tuple elements based on value comparison.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"where tuple[index] in/not in (values)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"where tuple[-1] not in (ip4(95.63.39.51))","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Matches filtered criteria","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Sub-query (key lookup)","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Finds the occurrence of a key in another dataset during the same period.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"(from dataset group by key select key) -> key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"(from siem.logtrust.web.navigation group by srcHost select srcHost) -> srcHost","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Matched key occurrence","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"Matches key type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Sub-query (field lookup)","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Returns a field from another table matching a condition.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"(from dataset group by field1, field2)[key]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"(from siem.logtrust.web.navigation group by userEmail, origin)[username]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"origin","type":"text","marks":[{"type":"code"}]},{"text":" field value","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"Matches field type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Sub-query (tuple matching)","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Returns a tuple from another table matching specified conditions.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[128.0]},"content":[{"type":"paragraph","content":[{"text":"(from dataset group by tuple_field select fields)[key1, key2]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"(from siem.logtrust.web.navigation group by userEmail, level select userEmail, count())[username, level]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"(userEmail, count)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"tuple(varied types)","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Common Operations:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a tuple","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select mktuple(username, ip4(srcHost), mm2coordinates(ip4(srcHost)), true) as tuple","type":"text"}]},{"type":"codeBlock","content":[{"text":"select (username ,srcPort, ip4(srcHost), true) as tuple2","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access tuple elements by index","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"select tuple[0] as first_item_from_tuple","type":"text"}]},{"type":"codeBlock","content":[{"text":"select tuple[-1] as last_item_from_tuple_","type":"text"}]},{"type":"codeBlock","content":[{"text":"select at(tuple,0) as first_item_from_tuple2","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Filter tuples by type","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"where tuple[0] -> \"@\"","type":"text"}]},{"type":"codeBlock","content":[{"text":"where tuple[-1] not in (ip4(95.63.39.51))","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SUB-QUERY: find the occurrence of a specific IP in another table during the same period of time","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"select (from siem.logtrust.web.navigation group by srcHost select srcHost) -> srcHost as _ip_occurrence_in_another_table","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SUB-QUERY: return the \"origin\" field in another table matching by user email","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"select (from siem.logtrust.web.navigation group by userEmail, origin)[username] as userInSubq","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SUB-QUERY: return the tuple (userEmail, count()) from another table matching by the tuple (email, level)","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"select (from siem.logtrust.web.navigation group by userEmail, level select userEmail, count())[username, level] as match","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Test them together in Data Search","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sql"},"content":[{"text":"from siem.logtrust.web.activity\n//create a tuple with multiple types\n select mktuple(username, ip4(srcHost), mm2coordinates(ip4(srcHost)), true) as tuple\n select (username ,srcPort, ip4(srcHost), true) as tuple2\n//some ways to select the first item from a tuple\n select tuple[0] as first_item_from_tuple\n select tuple[-1] as last_item_from_tuple_\n select at(tuple,0) as first_item_from_tuple2\n//SUB-QUERY: find the occurrence of a specific IP in another table during the same period of time\n select (from siem.logtrust.web.navigation group by srcHost select srcHost) -> srcHost as _ip_occurrence_in_another_table\n//SUB-QUERY: return the \"origin\" field in another table matching by user email\n select (from siem.logtrust.web.navigation group by userEmail, origin)[username] as userInSubq\n//SUB-QUERY: return the tuple (userEmail, count()) from another table matching by the tuple (email, level)\n select (from siem.logtrust.web.navigation group by userEmail, level select userEmail, count())[username, level] as match\n//it is possible to filter each item by the underlying data type\n where tuple[0] -> \"@\"\n where tuple[-1] not in (ip4(95.63.39.51))","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"JSON","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Then JSON format is fully supported in Devo","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"4e7322f6-442b-4cb5-b576-5630dc90caae"}}]},{"text":". It is useful for representing structured data in an unordered format, enabling flexible data storage and manipulation.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In Data Search: you can use the \"pretty-print\" view to inspect the content of JSON cells and extract the values that you need. ","type":"text"},{"text":"How?","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/space/latest/95191311/Working+with+JSON+objects+in+data+tables#Check-JSON-content-using-the-pretty-print-view"}}]}]}]}]},{"type":"paragraph","content":[{"text":"Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"a\": \"b\",\n \"c\": 1,\n \"d\": [1, 2, 3],\n \"e\": {\n \"f\": 1\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Key Characteristics:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unordered","type":"text","marks":[{"type":"strong"}]},{"text":": The sequence of keys is not guaranteed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unique Keys","type":"text","marks":[{"type":"strong"}]},{"text":": Each key must be unique within the object.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mixed Types","type":"text","marks":[{"type":"strong"}]},{"text":": Values can be strings, numbers, booleans, arrays, or other JSON objects.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Flexible","type":"text","marks":[{"type":"strong"}]},{"text":": Supports nested objects and arrays for complex structures.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"56047d2b-3968-43af-a933-dd1d483d41ac"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Operation","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"Syntax","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Result","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"Result Type","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"jqeval()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95198042"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Extracts values from JSON objects using a ","type":"text"},{"text":"jq","type":"text","marks":[{"type":"code"}]},{"text":" filter.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"jqeval(jq_filter, json_field)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"jqeval(jqcompile(\".email\"), json)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Extracted value from JSON","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"Matches field type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"jqcompile()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95198077"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Compiles a string as a ","type":"text"},{"text":"jq","type":"text","marks":[{"type":"code"}]},{"text":" filter to be used in ","type":"text"},{"text":"jqeval","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"jqcompile(filter)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"jqcompile(\".email\")","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"A compiled ","type":"text"},{"text":"jq","type":"text","marks":[{"type":"code"}]},{"text":" filter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"jq","type":"text","marks":[{"type":"code"}]},{"text":" filter","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"label()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95197976"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Returns the data type of a value inside a JSON object.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"label(json_field)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"label(json.email)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"\"string\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"string","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"jsonparse()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95198015"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Converts a string field to a JSON data type.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"jsonparse(string_field)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"jsonparse(data_string)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"JSON object","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"json","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"str()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95194741"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Converts a JSON object or other data type to a string.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"str(value)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"str(jqeval(jqcompile(\".email\"), json))","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Extracted value as a string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"string","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"at() []","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/389152771"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Given a map, returns the","type":"text"},{"type":"hardBreak"},{"text":"value associated to a","type":"text"},{"type":"hardBreak"},{"text":"given key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"at (json, key)","type":"text"},{"type":"hardBreak"},{"text":" json [key]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"json[\"int\"]","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"at(json, \"int\")","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Extract a value from a key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"Matches field type","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"stringify()","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/95194793"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[142.0]},"content":[{"type":"paragraph","content":[{"text":"Converts a JSON object (","type":"text"},{"text":"json","type":"text","marks":[{"type":"em"}]},{"text":" data type) into","type":"text"},{"text":" string ","type":"text","marks":[{"type":"em"}]},{"text":"data type.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"stringify(json_type)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"stringify(json_type)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"{“a“: 1, “b“: ”c”}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[101.0]},"content":[{"type":"paragraph","content":[{"text":"string","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Common Operations:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Parse String to JSON","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","content":[{"text":"select jsonparse(\"{\\\"str\\\": \\\"hi\\\", \\\"int\\\": 1}\") as json","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extract a Property Value","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","content":[{"text":"select json[\"int\"] as extract_int //doesn't work in Data Search at the moment","type":"text"}]}]},{"type":"listItem","content":[{"type":"codeBlock","content":[{"text":"select jqeval(jqcompile(\".int\"), json) as extract_int_alt","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Convert a JSON to a string","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","content":[{"text":"select stringify(json) as json_to_strinc","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Determine Data Type of a JSON Value","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","content":[{"text":"select label(jqeval(jqcompile(\".int\"), json)) as int_type","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Test them together in Data Search","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sql"},"content":[{"text":"from siem.logtrust.web.activity\n//create a JSON object\n select jsonparse(\"{\\\"str\\\": \\\"hi\\\", \\\"int\\\": 1}\") as json\n//Extract a Property Value\n //select json[\"int\"] as extract_int //doesn't work in Data Search at the moment\n select jqeval(jqcompile(\".int\"), json) as extract_int_alt\n//Convert a JSON to a string\n select stringify(json) as json_to_strinc\n//Determine Data Type of a JSON Value\n select label(jqeval(jqcompile(\".int\"), json)) as int_type","type":"text"}]}],"version":1}

Browser not supported