Operations reference

Absolute URI

Filter - Retrieves only absolute URIs from a specified field.

Create column - Creates a Boolean column that shows true if a given URI is absolute.

absoluteuri(string)  →  boolean

Absolute value

Create column - Adds a new column that returns the non-negative values of the numbers in a numeric field.

abs(number)  →  number

Addition, sum, plus / Concatenation

Create column - Adds a new column that returns the addition or concatenation of the elements in the given fields.

Depending on the input data types, this operation retrieves different results. See the operation article for more details.

number1 + number2 +... → number

duration1 + duration2 +... → duration

timestamp + duration → timestamp

string1 + string2 +... → string

add(number1, number2,...) → number

add(duration1, duration2,...) → duration

add(timestamp, duration) → timestamp

add(string1, string2,...) → string

And

Filter - Retrieves those events where all the given Boolean column values are true.

Create column - Creates a Boolean column that returns true only if all the given arguments are true.

boolean1 and boolean2 and ... → boolean

Any name matches

Filter - Filters a field containing sets of names in set(name) format and shows only those values that match one or more of the specified patterns.

Create column - Creates a new Boolean column that shows true when the values in a set(name) field match one or more of the specified patterns.

Learn more about the set(name) and namepattern data types in the operation article.

anymatches(setname, nameglob(string)) → boolean

anymatches(setname, namepattern) → boolean

Approximated estimation

Create column - Computes the approximated estimation of a set of distinct counts in dc data type.

Learn more about the dc data type in the operation article.

estimation(dc) → float

Arc cosine

Create column - Adds a new column that returns the arc cosine of the values of a numeric field.

acos(number) → float

Arc sine

Create column - Adds a new column that returns the arc sine of the values of a numeric field.

asin(number) → float

Arc tangent

Create column - Creates a new column that returns the arc tangent of the values of a numeric field. When applied with two arguments, it returns the arc tangent of the specified x- and y-coordinates.

atan(number) → float

atan(number1, number2) → float

Average

Aggregation - Calculates the average of the grouped values of the selected numeric field.

avg(number) → number

Bitwise AND

Create column - Creates a new column that retrieves the Bitwise AND of the specified arguments.

band(integer1, integer2) → integer

integer1 & integer2 → integer

Bitwise left shift

Create column - Creates a new column that shifts to the left the bits of the values in the first argument as many positions as specified in the second argument.

lshift(integer1, integer2) → integer

integer1 << integer2 → integer

Bitwise NOT

Create column - Creates a new column that retrieves the Bitwise NOT of the specified argument.

bnot(integer) → integer

~(integer) → integer

Bitwise OR

Create column - Creates a new column that retrieves the Bitwise OR of the specified arguments.

bor(integer1, integer2) → integer

integer1 | integer2 → integer

Bitwise right shift

Create column - Creates a new column that shifts to the right the bits of the values in the first argument as many positions as specified in the second argument.

This operation keeps the sign bit intact, so the sign of the original number is always preserved. Use Bitwise unsigned right shift (urshift, >>>) if you don't want to preserve the sign bit.

rshift(integer1, integer2) → integer

integer1 >> integer2 → integer

Bitwise unsigned right shift

Create column - Creates a new column that shifts to the right the bits of the values in the first argument as many positions as specified in the second argument.

This operation always fills vacant places after shifting with zeros, so the sign of the original number may vary. Use Bitwise right shift (rshift, >>) if you want to preserve the sign of the original number.

urshift(integer1, integer2) → integer

integer1 >>> integer2 → integer

Bitwise XOR

Create column - Creates a new column that retrieves the Bitwise XOR of the specified arguments.

bxor(integer1, integer2) → integer

integer1 ^ integer2 → integer

Ceiling

Create column - Adds a new column that rounds the values of a numeric field, returning the smallest following integer numbers.

Use Floor (floor) if you want to get the largest previous integers.

ceil(number) → number

Conditional

Create column - Adds a new column that returns the second argument if the column given as first argument (must be a Boolean field) shows true, and the third argument if it shows false.

ifthenelse(boolean, value1_true, value2_false) → value

Contains

Filter - Checks for the presence of one or more values in a given string. The filter will identify those strings containing at least one of the indicated values.

Create column - Creates a Boolean column that shows true when at least one of the indicated values is present in the given string.

If you enter your query using LINQ, note that the -> operator syntax does not admit more than two arguments. Use the has() syntax if you need to add more than one value.

This operation is case sensitive. Use the Contains - case insensitive (weakhas) operation if you need to apply this filter ignoring case.

string_general -> string_value → boolean

has(string_general, string_value1, string_value2...) → boolean

Contains - case insensitive

Filter - Returns only those strings that contain a specified value, ignoring case.

Create column - Creates a Boolean column that shows true when the indicated value is present in the given string, ignoring case.

Use the Contains (has, ->) operation if you need to discriminate between uppercase and lowercase letters.

weakhas(string_general, string_value) → boolean

Contains tokens

Filter - Returns only those strings including a specific token. Optionally, you can add one or two boolean values to extend the left and right length of the token.

Create column - Adds a new Boolean column that shows true when a specific token is present in a given string. Optionally, you can add one or two boolean values to extend the left and right length of the token.

toktains(string1, string2) → boolean

toktains(string1, string2, boolean_left) → boolean

toktains(string1, string2, boolean_left, boolean_right) → boolean

Create column - Adds a new Boolean column that shows true when a specific token is present in a given string, ignoring case. Optionally, you can add one or two boolean values to extend the left and right length of the token.

weaktoktains(string1, string2)

weaktoktains(string1, string2, boolean_left)

weaktoktains(string1, string2, boolean_left, boolean_right)

Coordinates distance

Create column - Adds a new column that returns the distance in meters between two geocoords.

distance(geocoord1, geocoord2) → float

distance(geocoord(string1), geocoord(string2)) → float

distance(latlon(string1), latlon(string2)) → float

Cosine

Create column - Adds a new column that returns the cosine of the values of a numeric field.

cos(number) → float

Count

Aggregation - Returns either the number of events in each group (if you add no arguments) or the number of non-null values in each group (if you add an argument).

count() → integer

count(number) → integer

Cube root

Create column - Adds a new column that returns the cube root of the values of a given numeric field.

cbrt(number) → number

Day / day of the month

Create column - Returns the duration representation of 1 day (1d), or the day of the month from a given timestamp. Optionally, you can add a timezone different than your current one.

day() → 1d

day(timestamp) → integer

day(timestamp, timezone_string) → integer

dayname(timestamp)  →  integer

dayname(timestamp, locale_string) →  string

dayname(timestamp, locale_string, timezone_string)  →  string

daynumber(timestamp)  → integer

daynumber(timestamp, timezone_string)  →integer

Day of the week

Create column - Returns the day of the week from a given timestamp. Optionally, you can add a timezone different than your current one.

dayofweek(timestamp) → integer

dayofweek(timestamp, timezone_string) → integer

Day of the year

Create column - Returns the day of the year from a given timestamp. Optionally, you can add a timezone different than your current one.

dayofyear(timestamp) → integer

dayofyear(timestamp, timezone_string) → integer

Decode, switch

Create column - Conditional operation that evaluates the values in a specified field, verifies if they match a specified value and transform them into a different value in case they do. You can also set an additional value that will be returned when the values don't match.

This operation is a conditional control flow statement, but unlike the Conditional (ifthenelse) operation, multiple execution paths are allowed.

decode(when_field, is_value, transform_to_value)

decode(when_field, is_value, transform_to_value, otherwise_value)

decode(when_field, is_value, transform_to_value, is_value2, transform_to_value2...)

Division

Create column - The new column returns the division of two numbers or the division of a duration and an integer number.

When both numbers are integer and the division is not exact, the result will be the value of the quotient.

number1 \ number2 → integer

div(number1, number2) → integer

duration \ integer → duration

div(duration, integer) → duration

Division remainder

Create column - Adds a new column that returns the remainder of the division of the integer values in a field by another field or value.

The Modulo (mod, %%) operation also returns the remainder of a division, but applies a different formula to calculate it. Go to the operation article to learn more.

rem(integer1, integer2) → integer

integer1 % integer2 → integer

Duration

Create column -  Adds a new column that transforms a string representing an amount of time into duration type.

The input string must follow a specific format to be transformed. Learn more in the operation article.

duration(string) → duration

e (mathematical constant)

Create column - Adds a new column that returns the value of the Euler's number (2.718281828459045).

e()

Edit distance: Damerau

Create column - Creates a new column that returns the Damerau edit distance between two strings.

damerau(string1, string2) → integer

Edit distance: Hamming

Create column - Creates a new column that returns the Hamming edit distance between two strings.

hamming(string1, string2) → integer

Edit distance: Levenshtein

Create column - Creates a new column that returns the Levenshtein edit distance between two strings.

levenshtein(string1, string2) → integer

Edit distance: OSA

Create column - Creates a new column that returns the OSA edit distance between two strings.

osa(string1, string2) → integer

Ends with

Filter - Filters string values that end with a specified suffix.

Create column - Creates a Boolean column that shows true for those strings that end with a specified suffix.

endswith(string1, string2_suffix) → boolean

Epoch milliseconds

Create column - Creates a new column that converts a specified timestamp into an epoch reference date: number of milliseconds since midnight Jan 1, 1970.
See also the Timestamp (timestamp) function, which transforms epoch dates or strings representing dates into timestamps.

epoch(timestamp) → integer

epoch(timestamp(string)) → integer

epoch(timestamp(integer)) → integer

Equal

Filter - Compares two values of the same type and returns only the events where both values are exactly the same.

Create column - Creates a Boolean column that shows true when two values are exactly the same.

This operation is case sensitive. Use Equal - case insensitive (eqic) if you need to apply this operation ignoring case.

field1 = field2 → boolean

eq(field1, field2) → boolean

Equal - case insensitive

Filter - Compares if two strings are the same. It returns only the rows where both values are the same, ignoring case.

Create column - Creates a Boolean column that shows true when two strings are exactly the same, ignoring case.

Use the Equal (eq, =) operation if you need to discriminate between uppercase and lowercase letters.

eqic(string1, string2) → boolean

Ethernet destination MAC address

Create column - Returns the destination MAC address of an Ethernet frame.

etherdst(packet) → mac

Ethernet payload

Create column - Returns the payload of an Ethernet frame.

etherpayload(packet) → boxar(int1)

Ethernet source MAC address

Create column - Returns the source MAC address of an Ethernet frame.

ethersrc(packet) → mac

Ethernet status

Create column - Returns the status of an Ethernet packet.

etherstatus(packet) → string

Ethernet tag

Create column - Returns the tag of an Ethernet Frame.

ethertag(packet) → string

EtherType

Create column - Returns the EtherType of the Ethernet frame of a packet.

ethertype(packet) → integer

Exponential: base e

Create column - Returns the value of the constant e to the power of the values in a specified field.

exp(number) → float

First

Aggregation - Returns the first value of a specified column for each group.

first(field) → value

First not null

Aggregation - Returns the first non-null value of a specified column for each group.

nnfirst(field) → value

Floor

Create column - Rounds the values of a numeric field, returning the largest previous integer values in the new column.

Use Ceiling (ceil) if you want to get the smallest following integers.

floor(number) → number

Format date

Create column - Format a given timestamp using a custom format, optionally specifying a different time zone and a locale.

formatdate(timestamp, string_format) → timestamp

formatdate(timestamp, string_format, string_timezone) → timestamp

formatdate(timestamp, string_format, string_timezone, string_locale) → timestamp

Format number

Create column - Converts a number according to a format and an optional locale. It is used to separate the digits following the specified format. The result will be a new column containing the strings formatted as specified, depending on the locale (if set).

See the operation article for the syntax accepted for the format pattern and the locale.

formatnumber(number, string_format) → string

formatnumber(number, string_format, string_locale) → string

From base16, b16, hex

Create column - Creates a byte array from a valid hexadecimal (base16) string.

from16(hex_string) → boxar(int1)

hex8(string) → integer

From base64, b16 

Create column - Creates a byte array from a valid base64 string.

from64(base64_string) → boxar(int1)

From UTF8

Create column - Returns an UTF8 string from the given byte array.

fromutf8(boxar(int1)) → string

fromutf8(from16(string)) → string

fromutf8(mkboxar(integer)) → string

From Z85, base85

Create column - Creates a byte array from a valid Z85 string.

fromz85(Z85_string) → boxar(int1)

Geocoord

Create column - Generates a geocoord from the given string, which must be either the representation of sexagesimal coordinates, using degrees, minutes, seconds and position (for example 40°24'46.3"N 3°41'43.8"W) or a hash representation of coordinates (for example ezjmguvj)

geocoord(string) → geocoord


Geographic coordinate system

Create column - Returns the coordinate system of a given geocoord.

coordsystem(geocoord) → string

coordsystem(geocoord(string)) → string

Geohash

Create column - Generates a geohash from a given geocoord, or converts a string representing a geohash to geohash format. If you enter a geocoord as input, you can optionally select the size of the output geohash.

geohash(string) → geocoord

geohash(geocoord) → geocoord

geohash(geocoord, size_integer) → geocoord

geohash(geocoord(string) → geocoord

geohash(geocoord(string), size_integer) → geocoord

Geohash string

Create column - Transforms a given geohash in geocoord data type into string data type. You can optionally select the size of the output string.

geohashstr(geocoord) → string

geohashstr(geocoord, size_integer) → string

Geolocated Accuracy Radius with MaxMind GeoIP2

Create column - Geolocates an IPv4 or IPv6 address and returns the accuracy radius, in km, around the latitude and longitude with a 67% confidence, using MaxMind IP geolocation.

mm2accuracyradius(ip) → float

mm2accuracyradius(ip6) → float

Geolocated AS Organization Name with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the organization associated with the registered autonomous system number, using MaxMind IP geolocation.

mm2asorg(ip) → string

mm2asorg(ip6) → string

Geolocated AS owner

Create column - Geolocates an IPv4 address and returns its corresponding AS (autonomous system) owner name.

mmasowner(ip) → string

Geolocated ASN

Create column - Geolocates an IPv4 address and returns the ASN (autonomous system number). 

mmasn(ip) → integer

Geolocated ASN with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the autonomous system number, using MaxMind IP geolocation.

mm2asn(ip) → integer

mm2asn(ip6) → integer

Geolocated City

Create column - Geolocates an IPv4 address and returns the corresponding city name.

mmcity(ip) → string

Geolocated City with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the corresponding city name, using MaxMind IP geolocation.

mm2city(ip) → string

mm2city(ip6) → string

Geolocated Connection Speed

Create column - Geolocates an IPv4 address and returns the corresponding connection speed category.

mmspeed(ip) → string

Geolocated connection type with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the connection type, using MaxMind IP geolocation. The possible connection type values are Dialup, Cable/DSL, Corporate or Cellular.

mm2con(ip) → string

mm2con(ip6) → string

Geolocated Coordinates

Create column - Geolocates an IPv4 address and returns its coordinates.

mmcoordinates(ip) → geocoord

Geolocated coordinates with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns its coordinates, using MaxMind IP geolocation.

mm2coordinates(ip) → geocoord

mm2coordinates(ip6) → geocoord

Geolocated Country

Create column - Geolocates an IPv4 address and returns the corresponding country code.

mmcountry(ip) → string

Geolocated Country with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the corresponding country name (as a two-character ISO 3166-1 code), using MaxMind IP geolocation.

mm2country(ip) → string

mm2country(ip6) → string

Geolocated ISP 

Create column - Geolocates an IPv4 address and returns the corresponding ISP name.

mmisp(ip) → string

Geolocated ISP name with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns its ISP name (Internet Server Provider), using MaxMind IP geolocation.

mm2isp(ip) → string

mm2isp(ip6) → string

Geolocated Latitude

Create column - Geolocates an IPv4 address and returns its corresponding latitude. 

mmlatitude(ip) → float

Geolocated Latitude with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the approximate latitude, using MaxMind IP geolocation.

mm2latitude(ip) → string

mm2latitude(ip6) → string

Geolocated Level 1 Subdivision with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the level 1 subdivision or region name using MaxMind IP geolocation.

mm2subdivision1(ip) → string

mm2subdivision1(ip6) → string

Geolocated Level 2 Subdivision with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the level 2 subdivision or region name using MaxMind IP geolocation.

mm2subdivision2(ip) → string

mm2subdivision2(ip6) → string

Geolocated Longitude

Create column - Geolocates an IPv4 address and returns the corresponding longitude.

mmlongitude(ip) → float

Geolocated Longitude with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the approximate longitude, using MaxMind IP geolocation.

mm2longitude(ip) → float

mm2longitude(ip6) → float

Geolocated Organization

Create column - Geolocates an IPv4 address and returns the corresponding organization name.

mmorg(ip) → string

Geolocated organization name with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the organization name, using MaxMind IP geolocation.

mm2org(ip) → string

mm2org(ip6) → string

Geolocated Postal Code

Create column - Geolocates an IPv4 address and returns the corresponding postal code.

mmpostalcode(ip) → string

Geolocated Postal Code with MaxMind GeoIP2 

Create column - Geolocates an IPv4 or IPv6 address and returns the postal code, using MaxMind IP geolocation.

mm2postalcode(ip) → string

mm2postalcode(ip6) → string

Geolocated Region

Create column - Geolocates an IPv4 address and returns the corresponding region code.

mmregion(ip) → string

Geolocated Region Name

Create column - Geolocates an IPv4 address and returns the corresponding region name.

mmregionname(ip) → string

Glob pattern on names

Create column - Creates a glob pattern on names (namepattern data type). Glob patterns specify sets of filenames with wildcard characters and are required when using the Any name matches operation

nameglob(string) → namepattern

Greater or equal

Filter - Filters those events where a value is greater than or equal to either another field of the same data type or a specified value.

Create column - Creates a Boolean column that shows true when a value is greater than or equal to either another field of the same data type or a specified value.

value1 >= value2 → boolean

ge(value1, value2) → boolean

Greater than

Filter - Filters those events where a value is greater than either another field of the same data type or a specified value.

Create column - Creates a Boolean column that shows true when a value is greater than either another field of the same data type or a specified value.

value1 > value2 → boolean

gt(value1, value2) → boolean

Has Ethernet frame

Create column - Creates a Boolean column that shows true if a specified packet has an Ethernet frame.

hasether(packet) → boolean

Has IPv4 datagram

Create column - Creates a Boolean column that shows true if a specified packet has an IPv4 datagram.

hasip4(packet) → boolean

Has TCP segment

Create column - Creates a Boolean column that shows true if a specified packet has a TCP segment.

hastcp(packet) → boolean

Has UDP datagram

Create column - Creates a Boolean column that shows true if a specified packet has a UDP datagram.

hasudp(packet) → boolean

Hostname public suffix

Create column - Extracts the public suffix from the hostnames in a given string field.  

publicsuffix(string) → string

Hostname root domain

Create column - Extracts the root domain from the hostnames in a given string field.

rootdomain(string) → string

Hostname root prefix

Create column - Extract the root prefix from the hostnames in a given string field. A root prefix includes everything that comes before the root domain, including it.

rootprefix(string) → string

Hostname root suffix

Create column - Extract the root suffix from the hostnames in a given string field. A root suffix includes everything that comes after the root domain, including it.

rootsuffix(string) → string

Hostname subdomains

Create column - Extract the subdomain from the hostnames in a given string field.

subdomain(string) → string

Hostname top level domain

Create column - Extracts the top-level domain (TLD) from the hostnames in a given string field.

topleveldomain(string) → string

Hour

Create column - Returns the duration representation of 1 hour, or the hours corresponding to a given timestamp. Optionally, you can add a timezone different than your current one.

hour() → 1h

hour(timestamp) → duration

hour(timestamp, timezone_string) → duration

HTTP Status Description

Create column - Returns the HTTP status description from a given HTTP status code.

httpstatusdescription(integer) → string

HTTP Status Type

Create column - Returns the HTTP status type from a given HTTP status code.

httpstatustype(integer) → string

Human size

Create column - Converts a number into a human-readable format, using a binary prefix by default. Optionally, you can add a second boolean argument to specify the required format (true is for binary prefix (2x) and false for decimal prefix (10x).

humanSize(integer) → string

humanSize(integer, boolean) → string

Hyperbolic cosine

Create column - Returns the hyperbolic cosine of the specified number.

cosh(number) → float

Hyperbolic sine

Create column - Returns the hyperbolic sine of the specified number.

sinh(number) → float

Hyperbolic tangent

Create column - Returns the hyperbolic tangent of the specified number.

tanh(number) → float

HyperLogLog++

Aggregation - Applies the HyperLogLog++ algorithm to the groups of a specified field, which is used to calculate the estimated count of distinct elements in each group. The output data type is dc (distinct count).

This operation returns the same results as the HyperLogLog++ Count Estimation (hllppcount) operation, the only difference is the output data type.

hllpp(field) → dc

HyperLogLog++ Count Estimation

Aggregation - Applies the HyperLogLog++ algorithm to the groups of a specified field, which is used to calculate the estimated count of distinct elements in each group. The output data type is float.

This operation returns the same results as the HyperLogLog++ operation, the only difference is the output data type.

hllppcount(field) → float

HyperLogLog++ pack

Create column - Transforms a byte array of data type dc to a hexadecimal string of data type boxar(int1)

pack(dc) → boxar(int1)

HyperLogLog++ unpack

Create column - Transforms a hexadecimal string of data type boxar(int1) into a byte array of data type dc.

unpackhllpp(boxar(int1)) → dc

IP Protocol

Create column - Converts an IP protocol name to its protocol code or vice versa.

ipprotocol(protocol_name_string) → integer

ipprotocol(protocol_code_integer) → string

IP Reputation Score

Create column - Assigns a reputation score to an IPv4 address according to several IP reputation lists.

reputationscore(ip) → integer

IP Reputation Tags

Create column - Labels an IPv4 address according to several IP reputation lists.

reputation(ip) → string

IPv4 destination address

Create column - Returns the destination IPv4 address of a specified IPv4 datagram (packet data type).

ip4dst(packet) → ip

IPv4 differentiated services

Create column - Returns the Differentiated Services Code Point (DSCP) of a specified IPv4 datagram (packet data type).

ip4ds(packet) → integer

IPv4 explicit congestion notification

Create column - Returns the Explicit Congestion Notification (ECN) of a specified IPv4 datagram (packet data type).

ip4ecn(packet) → integer

IPv4 flags

Create column - Returns the flag value of a specified IPv4 datagram (packet data type).

ip4flags(packet) → integer

IPv4 fragment offset

Create column - Returns the fragment offset of a specified IPv4 datagram (packet data type).

ip4fragment(packet) → integer

IPv4 header checksum

Create column - Returns the header of a specified IPv4 datagram (packet data type).

ip4cs(packet) → integer

IPv4 header length

Create column - Returns the Internet header length (IHL) of a specified IPv4 datagram (packet data type).

ip4hl(packet) → integer

IPv4 identification

Create column - Returns the identification field value of a specified IPv4 datagram (packet data type).

ip4ident(packet) → integer

IPv4 legal use

Create column - Returns the purpose or legal use of the given IPv4 address.

purpose(ip) → integer

IPv4 payload

Create column - Returns the payload of a specified IPv4 datagram (packet data type).

ip4payload(packet) → boxar(int1)

IPv4 protocol

Create column - Returns the protocol field value of a specified IPv4 datagram (packet data type).

ip4proto(packet) → integer

IPv4 source address

Create column - Returns the source IPv4 address of a specified IPv4 datagram (packet data type).

ip4src(packet) → ip

IPv4 status

Create column - Returns the status of a specified IPv4 datagram (packet data type).

ip4status(packet) → string

IPv4 time to live

Create column - Returns the time to live (TTL) value in seconds of a specified IPv4 datagram (packet data type).

ip4ttl(packet) → integer

IPv4 total length

Create column - Returns the total length field value of a specified IPv4 datagram (packet data type).

ip4len(packet) → integer

IPv4 type of service

Create column - Returns the type of service field value of a specified IPv4 datagram (packet data type).

ip4tos(packet) → integer

IPv6 host number 

Create column - Returns the host number of an IPv6 address.

host(ip6) → integer

IPv6 routing number

Create column - Returns the routing part of an IPv6 address.

routing(ip6) → integer

Filter - Checks if a given string is empty. 

Create column - Adds a new Boolean column that shows true only for those strings that are empty.

Is in

Filter - Checks for the presence of one or more values in a given string. The filter will identify those strings containing at least one of the indicated values.

You can also use it to filter IPv4 addresses that belong to a specific net.

Create column - Adds a new Boolean column that shows true only for those strings that contain at least one of the indicated values. 

You can also use it to create a new column that shows true for IPv4 addresses that belong to a specific net.

If you enter your query using LINQ, note that the <- operator syntax does not admit more than two arguments. Use the `in`() syntax if you need to add more than one value.

This operation is case sensitive. Use the Is in - case insensitive (weakin) operation if you need to apply this filter ignoring case.

Is in - case insensitive

Filter - Returns only those strings that contain a specified value, ignoring case.

Create column - Creates a Boolean column that shows true only for those strings that contain a specified value, ignoring case.

Use the Is in (`in`, <-) operation if you need to discriminate between uppercase and lowercase letters.

weakin(string_value, string_general) → boolean

Is IPv4 

Create column - Creates a Boolean column that returns true if a specified IPv6 is carrying an IPv4.

isip4(ip6) → boolean

Is not null

Filter - Filters non-null values in a given column.

Create column - Creates a Boolean column that shows true if a given value is not null.

isnotnull(field) → boolean

Is null

Filter - Filters null values in a given column.

Create column - Creates a Boolean column that shows true if a given value is null.

isnull(field) → boolean

Is Private IPv4

Filter - Returns only the private IP addresses of a selected ip column.

Create column - Creates a Boolean column that shows true if a given IP address is private.

isprivate(ip) → boolean

Is Public IPv4

Filter - Returns only the public IP addresses of a selected ip column.

Create column - Creates a Boolean column that shows true if a given IP address is public.

ispublic(ip) → boolean

ISO-3166-1 Continent Alpha-2 Code

Create column - Returns the ISO-3166-1 Continent Alpha-2 Code from any continent identification.

continentalpha2(continent_string) → string

ISO-3166-1 Continent Name

Create column - Returns the ISO-3166-1 Continent Name from any continent identification.

continentname(continent_string) → string

ISO-3166-1 Country Alpha-2 Code

Create column - Returns the ISO-3166-1 Country Alpha-2 Code from any country identification.

countryalpha2(country_string) → string

ISO-3166-1 Country Alpha-2 Continent

Create column - Returns the ISO-3166-1 Country Alpha-2 Continent from any country identification.

countrycontinent(country_string) → string

ISO-3166-1 Country Alpha-3 Code

Create column - Returns the ISO-3166-1 Country Alpha-3 Code from any country identification.

countryalpha3(country_string) → string

ISO-3166-1 Country Latitude

Create column - Returns the ISO-3166-1 Country Latitude from any country identification.

countrylatitude(country_string) → float

ISO-3166-1 Country Longitude

Create column - Returns the ISO-3166-1 Country Longitude from any country identification.

countrylongitude(country_string) → float

ISO-3166-1 Country Name

Create column - Returns the ISO-3166-1 Country Name from any country identification.

countryname(country_string) → string

Jq evaluation

Create column - Uses the jq JSON processor to identify and extract a single value from a JSON object contained in another column. 

jqeval(jqcompile(json_value), json) → json

Jq filter compilation

Create column - Compiles a jq filter to be used as an argument of the Jq evaluation (jqeval) operation. 

jqcompile(string) → jq

Json value type

Create column - Returns the type of the values in a JSON object. Note that you must first extract the part of the JSON you want to analyze using the Jq evaluation (jqeval) operation.

label(json_value) → string

Last

Aggregation - Returns the last value of the selected field for each group.

last(field) → value

Last not null

Aggregation - Returns the last non-null value of the selected field for each group.

nnlast(field) → value

Latitude

Create column - Returns the latitude of a given geocoord.

latitude(geocoord) → float

Latitude and longitude coordinates

Create column - Generates a geocoord based on sexagesimal coordinates. It can be done using latitude and longitude numerical values, another geocoord or a string representing coordinates.

latlon(latitude_float, longitude_float) → geocoord

latlon(geocoord) → geocoord

latlon(coordinates_string) → geocoord

isleapyear(timestamp) → string

isleapyear(timestamp, timezone_string) → string

Length

Create column - Adds a new column that returns the length of a string.

length(string) → integer

Less or equal

Filter - Filters those events where a value is less than or equal to either another field of the same data type or a specified value.

Create column - Creates a Boolean column that shows true when a value is less than or equal to either another field of the same data type or a specified value.

value1 <= value2 → boolean

le(value1, value2) → boolean

Less than

Filter - Filters those events where a value is less than either another field of the same data type or a specified value.

Create column - Creates a Boolean column that shows true when a value is less than either another field of the same data type or a specified value.

value1 < value2 → boolean

lt(value1, value2) → boolean

Locate

Create column - The column created returns the position of the first occurrence of a specified value in a string, counting from 0. Note that this operation is case sensitive.

locate(string, string_to_locate) → integer

Logarithm: base 10

Create column - Returns the base-10 logarithm of the selected number.

log10(number) → float

Logarithm: base 2

Create column - Returns the base-2 logarithm of the selected number.

log2(number) → float

Logarithm: natural / arbitrary base

Create column - Returns the base-e logarithm of the selected number. Optionally, you can add a second argument to calculate the log base x of a given number.

log(number) → float

log(base_number, number) → float

Longitude

Create column - Returns the longitude of a given geocoord.

longitude(geocoord) → float

Lower case

Create column - Adds a new column that converts a string to lowercase letters.

lower(string) → string

Make byte array

Create column - Creates a byte array from the given integer values (one or more).

mkboxar(integer1, integer2, integer3...) → boxar(int1)

Matches

Filter - Returns those strings that match an indicated regular expression.

Create column - Adds a new Boolean column that shows true when a string matches an indicated regular expression.

Note that when you enter a string value as a regular expression using LINQ, you have to transform it to regexp format using the Regular expression, regexp (re) operation, as you can see in the examples. This is not needed if you perform this operation directly from the search window interface.

string ~ re(string) → boolean

string ~ regexp → boolean

matches(string, re(string)) → boolean

matches(string, regexp) → boolean

Maximum

Aggregation - Returns the highest value of the selected field in each group 

Create column - Creates a column that shows the highest value in two or more numeric fields or values.

See also Minimum (min)

max(number)  → number   This format is only valid if you use the Aggregation operation, that is to say, you must group your data before using it.

max(number1, number2, number3...) → number 

MD5 hash function

Create column - Creates an MD5 hash as a byte array of the given string.

md5(string) → boxar(int1)

Median / 2nd quartile / Percentile 50

Aggregation - Returns the median of the values of the selected field in each group.

median(integer) → integer

Millisecond

Create column - Returns the duration representation of 1 millisecond, or the milliseconds corresponding to a given timestamp. Optionally, you can add a timezone different than your current one.

millisecond() → 1 

millisecond(timestamp) → integer

millisecond(timestamp, timezone_string) → integer

Minimum

Aggregation - Returns the lowest value of the selected field in each group.

Create column - Creates a column that shows the lowest value in two or more numeric fields or values.

See also Maximum (max)

min(number) → number   This format is only valid if you use the Aggregation operation, that is to say, you must group your data before using it.

min(number1, number2, number3...) → number

Minute

Create column - Returns the duration representation of 1 minute, or the minutes corresponding to a given timestamp. Optionally, you can add a timezone different than your current one.

minute() → 1m

minute(timestamp) → integer

minute(timestamp, timezone_string) → integer

minuteofday(timestamp)  → integer

minuteofday(timestamp, timezone_string)  → integer

Modulo

Create column - Adds a new column that returns the remainder of the division of the integer values in a field by another field or value.

Note that the divisor must be always a positive integer value, otherwise a null value will be returned.

The Division remainder (rem, %) operation also returns the remainder of a division, but applies a different formula to calculate it. Go to the operation article to learn more.

mod(integer1, integer2) → integer

integer1 %% integer2 → integer

Month

Create column - Returns the month from a given timestamp. Optionally, you can add a timezone different than your current one.

month(timestamp) → integer

month(timestamp, timezone_string) → integer

monthname(timestamp)  →  string

monthname(timestamp, locale_string) →  string

monthname(timestamp, locale_string, timezone_string)  → string

monthnumber(timestamp)  → integer

monthnumber(timestamp, timezone_string)  → integer

Multiplication, product

Create column - Creates a column that returns the product of two or more numbers or the product of an integer number and a duration.

number1 * number2 * number3... → number

mul(number1, number2, number3...) → number

integer * duration → duration

mul(integer, duration) → duration

Non-null average

Aggregation - Calculates the average of the non-null values of the selected field in each group.

nnavg(number) → number

Non-null standard deviation (biased)

Aggregation - Calculates the biased standard deviation of the non-null values of the selected field in each group.

nnstddev(number) → number

Non-null standard deviation (unbiased)

Aggregation - Calculates the unbiased standard deviation of the non-null values of the selected field in each group.

nnustddev(number) → number

Non-null variance (biased)

Aggregation - Calculates the biased variance of the non-null values of the selected field in each group.

nnvar(number) → number

Non-null variance (unbiased)

Aggregation - Calculates the unbiased variance of the non-null values of the selected field in each group.

nnuvar(number) → number

Not

Filter - Returns only the rows where the values in a specified Boolean column are false.

Create column - Creates a Boolean column that returns the complement of the values in another Boolean column (the complement of true is false and vice versa).

not boolean → boolean

Not equal

Filter - Compares two values of the same type and returns only the events where both values are not the same.

Create column - Creates a Boolean column that shows true when two values are not the same.

This operation is case sensitive, so same values in lowercase and uppercase will be considered as not equal.

value1 /= value2 → value

ne(value1, value2) → value

Null value locator

Create column - Adds a new column that returns the value specified as the second argument if the first one is null.

nvl(field_to_check, value_when_null) → value

Opaque URI

Filter - Retrieves only opaque URIs from a specified field.

Create column - Creates a Boolean column that shows true if a given URI is opaque.

opaqueuri(string) → boolean

Or

Filter - Retrieves those events where at least one of the given Boolean column values is true.

Create column - Creates a Boolean column that returns true only if and only if one of the given arguments are true.

boolean1 or boolean2 or ... → boolean

Parse date

Create column - Parses a string representing a date using a custom format, optionally specifying time zone and locale different than your current ones. See the operation article to check the format that the values entered must follow.

parsedate(string_to_be_parsed, format_string) → string

parsedate(string_to_be_parsed, format_string, time_zone_string) → string

parsedate(string_to_be_parsed, format_string, time_zone_string, locale_string) → string

Parse geocoord format

Create column - Parses a string representing a geocoord in a strict format (type:), as produced by the Represent geocoord format (reprgeo) operation. If the format is not valid, the result of the parsing will be null.

parsegeo(string) → string

Peek

Create column - The new column returns the part of a string that matches a given regular expression. Optionally, you can add a capturing group to get a specific substring in case of several matches (being the capturing group 0 the first occurrence )

Note that when you enter a string value as a regular expression using LINQ, you have to transform it to regexp format using the Regular expression, regexp (re) operation, as you can see in the examples. This is not needed if you perform this operation directly from the search window interface.

peek(string, re(string)) → string

peek(string, regexp) → string

peek(string, re(string), capturing_group_integer) → string

peek(string, regexp, capturing_group_integer) → string

Percentile 10

Aggregation - Returns the maximum value of the 10th percentile of the values in the selected group for each group, using linear interpolation.

percentile10(integer) → integer

Percentile 25 / 1st quartile

Aggregation - Returns the maximum value of the 25th percentile of the values in the selected group for each group, using linear interpolation.

percentile25(integer) → integer

Percentile 5

Aggregation - Returns the maximum value of the 5th percentile of the values in the selected group for each group, using linear interpolation.

percentile5(integer) → integer

Percentile 75 / 3rd quartile

Aggregation - Returns the maximum value of the 75th percentile of the values in the selected group for each group, using linear interpolation.

percentile75(integer) → integer

Percentile 90

Aggregation - Returns the maximum value of the 90th percentile of the values in the selected group for each group, using linear interpolation.

percentile90(integer) → integer

Percentile 95

Aggregation - Returns the maximum value of the 95th percentile of the values in the selected group for each group, using linear interpolation.

percentile95(integer) → integer

Period

Create column - Aligns a given timestamp to a specific duration or milliseconds value, considering the UTC value of the timestamp.

period(timestamp, duration) → timestamp

period(timestamp, integer) → timestamp

Pi (mathematical constant)

Create column - Adds a new column that returns the number Pi (3.141592653589793).

pi()

Power

Create column - Creates a column that returns the base specified raised to the power of an exponent.

pow(number_base, number_exponent) → number

Pragma value

Create column -Extracts the pragma value from a given query.

pragmavalue(language_string, query_string, pragma_key_string) → string

Real division

Create column - Creates a column that returns the real division of two numbers.

rdiv(number1, number2) → number

number1 / number2 → number

Regular expression, regexp

Create column - Builds a regular expression from the given string pattern.

re(string) → regexp

Replace all

Create column - Searches for a value in a given string and returns a new string where all the occurrences (if any) are replaced by another indicated value.

replaceall(string, string_to_search, string_to_replace) → string

Replace first

Create column - Searches for a value in a given string and returns a new string where only the first occurrence (if any) is replaced by another indicated value. 

replace(string, string_to_search, string_to_replace) → string

Represent geocoord format

Create column - Strict string representation of the given geocoord, in a specific format (type:), where type is the geocoord type.

reprgeo(geocoord) → geocoord

reprgeo(geocoord(string)) → geocoord

reverse(string) → string

reverse(boxar(int1)) → string

Round coordinates

Create column - Rounds geo-coordinates according to a grid divided depending on the given latitude and longitude precision (in degrees), or to a uniform grid with a specified number of divisions.

gridlatlon(geocoord, latitude_float, longitude_float) → geocoord

gridlatlon(geocoord, grid_size_integer) → geocoord

Rounding

Create column - Adds a new column that rounds the given number to the nearest integer or, if indicated, to a specified number of decimal places.

Use Floor (floor) if you want to get the largest previous integers, and Ceiling (ceil) to round to the smallest following integers.

round(number) → number

round(number, integer_decimals) → number

Second

Create column - Returns the duration representation of 1 second, or the seconds from a given timestamp. Optionally, you can add a timezone different than your current one.

second() → 1s

second(timestamp) → integer

second(timestamp, timezone_string) → integer

secondofday(timestamp)  → integer

secondofday(timestamp, timezone_string)  → integer

SHA1 hash function

Create column - Adds a new column that returns the SHA1 hash as a byte array of the given string.

sha1(string) → boxar(int1)

SHA256 hash function

Create column - Adds a new column that returns the SHA256 hash as a byte array of the given string.

sha256(string) → boxar(int1)

SHA512 hash function

Create column - Adds a new column that returns the SHA512 hash as a byte array of the given string.

sha512(string) → boxar(int1)

Shannon entropy

Create column - The new column returns the Shannon entropy of a given string.

shannonentropy(string) → float

Sign

Create column - The new column represents the sign of the specified numbers, represented as 1 (positive) or -1 (negative). Zero values will return 0.

signum(number) → integer