Cortex XQL Command Reference

Cortex XQL Command Reference
Overview
Functions
acos
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate arccosine of a literal value
Example 2: Calculate arccosine from a field value
Related Articles
add
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Adding an integer field and a literal integer
Example 2: Adding two integer literal values
Example 3: Adding a floating-point field and a literal float
Example 4: Adding an integer field and a negative literal
Example 5: Adding a number extracted as string and a literal
Example 6: Adding an element from an array field and a literal
Related articles
approx_count
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate approximate distinct count across the entire dataset
Example 2: Calculate approximate distinct count grouped by another field
Example 3: Calculate approximate distinct count with raw data inclusion
Related articles
approx_quantiles
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate approximate quantiles across the entire dataset
Example 2: Calculate approximate quantiles grouped by field
Example 3: Calculate approximate quantiles for distinct values
Related articles
approx_top
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Calculating approximate top counts (no weight field)
Example 2: Calculating approximate top sums (with weight field)
Example 3: Calculating approximate top sums grouped by another field
Example 4: Calculating approximate top counts with raw data inclusion
Related Articles**
asin
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate arcsine of literal values
Example 2: Calculate arcsine from a field value
Related articles
array_all
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Checking if all string tags are a specific value
Example 2: Checking if all numeric codes are greater than zero
Example 3: Checking if all string tags are NOT a specific value
Related articles
array_any
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Check for specific string value
Example 2: Check numeric threshold
Example 3: Check inequality
Related articles
array_length
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculating the length of a string array
Example 2: Calculating the length of a numeric array
Example 3: Calculating the length of an array of JSON objects
Example 4: Using array_length() in a filter to check for non-empty arrays
Example 5: Using array_length() in a filter to check for a specific array size
Related articles
arrayconcat
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Concatenating two newly created arrays
Example 2: Concatenating an existing array field with a newly created array
Example 3: Concatenating multiple derived arrays
Related articles
arraycreate
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Creating an array of string literals
Example 2: Creating an array with literals representing different data types (as strings)
Example 3: Creating an array by combining literals with existing field values
Example 4: Creating an array with derived values from JSON extraction
Related articles
arraydistinct
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Removing duplicate string literals from a newly created array
Example 2: Removing duplicate numeric literals from a newly created array
Example 3: Applying arraydistinct() to an existing array field
Example 4: arraydistinct() on an array constructed from mixed field values with duplicates
Example 5: arraydistinct() on a concatenated array with duplicates
Related articles
arrayfilter
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Filtering a string array for specific elements
Example 2: Filtering a numeric array for values greater than a threshold
Example 3: Filtering a string array for elements not equal to a value
Example 4: Filtering an array and checking its length in a filter stage
Related articles
arrayindex
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting the first element (Index 0) from a string array
Example 2: Extracting a middle element (Index 2) from a numeric array
Example 3: Handling an empty array
Example 4: Handling an out-of-bounds index
Example 5: Retrieving the last element (-1 Index)
Example 6: Retrieving the second to last element (-2 Index)
Related articles
arrayindexof
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: General condition - checking array length
Example 2: Element-specific condition - checking for a specific string value
Example 3: Element-specific condition - checking for a numeric value greater than a threshold
Example 4: Element-specific condition - checking for a value not equal to a specific string
Example 5: Handling an empty array explicitly
Related articles
arraymap
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Applying a simple mathematical transformation to a numeric array
Example 2: Applying a string transformation (uppercase) to a string array
Example 3: Applying a conditional transformation (replacing negative values) to a numeric array
Example 4: Extracting scalar values from JSON Objects within an array
Related articles
arraymerge
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Merging artificially constructed arrays (literal JSON strings)
Example 2: Merging scalar values extracted and wrapped into arrays via arraymap()
Example 2: Merge IP addresses extracted from a nested map
Related articles
arrayrange
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting a standard slice from a numeric array
Example 2: Extracting a slice where the end index is beyond the array's length
Example 3: Extracting a slice from a string array
Example 4: Handling an empty array input
Example 5: Using arrayrange() with dynamically created arrays
Related articles
arraystring
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a string array to a string with a comma and space delimiter
Example 2: Converting a numeric array to a string with a pipe delimiter
Example 3: Handling an empty array input
Example 4: Converting a dynamically sliced array to a string
Example 5: Using arraystring() in a filter stage
Example 6: Converting application transitions to a delimited string and deduplicating
Related articles
avg (comp)
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Average a field across the entire dataset
Example 2: Average a field grouped by another field
Example 3: Average with raw data inclusion
Related Articles
avg (windowcomp)
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: avg() over an entire partition (default window)
Example 2: avg() with a rolling window (preceding 2 rows and current row)**
Example 3: avg() with a fixed window (current row to unbounded following row)
Related Articles
bitwise_and
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Check a specific bit flag in an integer field
Example 2: Filter events using a bitwise AND with hexadecimal values
Example 3: Mask out the lower 8 bits of an integer field
Related articles
bitwise_or
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Set a specific bit flag in an integer field
Example 2: Combine two hexadecimal values and filter
Example 3: Merge flags from two separate fields
Related articles
bitwise_sleft
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Shift a field value left by 1 position
Example 2: Create a bitmask from a bit position
Example 3: Scale a value by a power of two and filter
Related articles
bitwise_sright
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Shift a field value right by 1 position
Example 2: Extract the upper byte from a 16-bit value
Example 3: Check a specific bit by shifting and masking
Related articles
bitwise_xor
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Toggle a specific bit flag in an integer field
Example 2: Detect differences between two bitmask fields
Example 3: Filter events where specific bits changed
Related articles
cbrt
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate cube root of literal values
Example 2: Calculate cube root from a field value
Example 3: Combine cube root with other operations
Related articles
ceil
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Round up positive floating-point field
Example 2: Round up calculated floating-point value
Example 3: Round up negative number
Example 4: Round up number extracted from JSON
Related articles
coalesce
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Coalescing literal values of different types
Example 2: Coalescing existing fields
Example 3: Coalescing multiple JSON paths for a single concept
Example 4: Coalescing complex nested JSON paths for a unified identifier
Example 5: Selecting the first non-null username from multiple fields
Related articles
concat
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Concatenating two string literal values
Example 2: Concatenating a string literal with a field value
Example 3: Concatenating multiple field values
Example 4: Concatenating extracted JSON scalar values
Example 5: Concatenating converted boot time values
convert_from_base_64
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Decoding a basic literal base64 string
Example 2: Decoding a literal base64 string representing JSON
Example 3: Handling an invalid base64 input
Example 4: Decoding an empty base64 string
Related articles
convert_to_base_64
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Encoding a basic literal string
Example 2: Encoding an existing string field
Example 3: Encoding a string derived from a numeric field
Example 4: Encoding an empty string
Example 5: Handling NULL input
Related articles
cos
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate cosine of literal values
Example 2: Calculate cosine from a field value
Example 3: Use cosine in a distance calculation
Related articles
cosine_distance
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate cosine distance between literal vectors
Example 2: Calculate cosine distance between field vectors
Example 3: Compare similarity of two records
Related articles
cot
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate cotangent of literal values
Example 2: Calculate cotangent from a field value
Example 3: Verify cotangent as reciprocal of tangent
Related articles
count (comp)
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Counting all rows across the entire dataset (no field specified)
Example 2: Counting non-null values of a specific field across the entire dataset (field specified)
Example 3: Counting non-null values of a specific field, grouped by another field
Example 4: Counting a value extracted and converted from JSON data
Example 5: Counting a numerical value from an array element
Example 6: Counting with raw data inclusion (addrawdata=true)
Related Articles
count (windowcomp)
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Over an entire partition (no field specified - counts all rows)
Example 2: Over an entire partition (field specified - counts non-null values)
Example 3: Rolling window (preceding 2 rows and current row, no field)
Example 4: Fixed window (current row to unbounded following, field specified)
Related Articles
count_distinct
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Counting Unique Values of a Specific Field Across the Entire Dataset (No Grouping)
**Example 2: Counting Unique Values of a Specific Field, Grouped by Another Field
Example 3: Counting Unique Values of a Derived Field (JSON Extraction and Conversion)
Example 4: Counting Unique Numerical Values from an Array Element
Example 5: Counting Unique Values with Raw Data Inclusion (addrawdata=true)
Related Articles
csc
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate cosecant of literal values
Example 2: Calculate cosecant from a field value
Example 3: Verify cosecant as reciprocal of sine
Related articles
current_time
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Assigning current_time() to a new field in an alter stage
Example 2: Using current_time() within timestamp_diff() in a filter stage
Example 3: Using current_time() within date_floor() in an alter Stage
Example 4: Using current_time() within extract_time() in an alter Stage
Example 5: Filtering events based on process execution age
Related articles
date_floor
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Rounding _time to the nearest hour (default UTC)
Example 2: Rounding _time to the nearest day (default UTC)
Example 3: Rounding _time to the nearest week (default UTC)
Example 4: Rounding _time to the nearest month (default UTC)
Example 5: Rounding _time to the nearest year (default UTC)
Example 6: Rounding current_time() to the nearest day with a specific time zone
Example 7: Filtering events relative to the start of the week with timezone adjustment
Related articles
div
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Integer division of literal values
Example 2: Integer division from field values
Example 3: Combine div with mod for quotient and remainder
Related articles
divide
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Dividing an integer field by an integer literal
Example 2: Dividing a floating-point field by an integer literal
Example 3: Dividing a floating-point field by a floating-point literal
Example 4: Dividing a numeric literal by a negative literal
Example 5: Dividing a string-converted-to-number field
Related articles
earliest
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Identify the First Process Executed per Host
Related Articles
euclidean_distance
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate Euclidean distance between literal vectors
Example 2: Calculate Euclidean distance between field vectors
Example 3: Find most similar records using Euclidean distance
Related articles
exp
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate exponential of literal values
Example 2: Calculate exponential from a field value
Example 3: Verify inverse relationship with ln
Related articles
extract_time
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting the YEAR
Example 2: Extracting the MONTH
Example 3: Extracting the DAY
Example 4: Extracting the DAYOFWEEK
Example 5: Extracting the DAYOFYEAR
Example 6: Extracting the HOUR
Example 7: Extracting the MINUTE
Example 8: Extracting the SECOND
Example 9: Extracting the MILLISECOND
Example 10: Extracting the MICROSECOND
Example 11: Extracting the QUARTER
Related articles
extract_url_host
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic host extraction from a standard URL
Example 2: Host extraction from a URL with user, password, and port
Example 3: Host extraction with mixed-case input
Example 4: Host extraction from a URL with multiple suffixes/paths
Example 5: Handling NULL input
Example: Host extraction from a URL string
Related articles
extract_url_pub_suffix
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic public suffix extraction from a standard URL
Example 2: Public suffix extraction from a URL with multiple suffixes/paths
Example 3: Public suffix extraction with mixed-case input
Example 4: Handling NULL input
Related articles
extract_url_registered_domain
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic registered domain extraction from a standard URL
Example 2: Registered domain extraction from a URL with multiple subdomains/paths
Example 3: Registered domain extraction with mixed-case input
Example 4: Handling URLs without a recognizable registered domain
Example 5: Handling NULL input
Related articles
first
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Identify the First Process Executed per Host
Example 2: Retrieve the First Command Line for a Process
Related Articles
first_value
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Establish an Initial Process Baseline per Host**
Example 2: Return the first value of a field
Related Articles
floor
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Round down positive floating-point field
Example 2: Round down calculated floating-point value
Example 3: Round down negative number
Example 4: Round down number extracted from JSON
Related articles
format_string
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic string substitution (%s)
Example 2: Integer substitution (%d)
Example 3: Combining different data types
Example 4: Padding and zero-padding for integers
Example 5: Formatting extracted JSON scalar values with integer conversion
Related articles
format_timestamp
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Without a time zone configured
Example 2: With a time zone configured using an hours offset
Example 3: With a time zone name configured
Related articles
greatest
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Find greatest among literal values
Example 2: Find greatest value across multiple fields
Example 3: Implement an upper bound using greatest
Related articles
if
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic if with a boolean field
Example 2: if with a numeric comparison
Example 3: if with string matching
Example 4: if with nested if for complex logic
Example 5: if returning numeric values with multiplication
Example 6: if with omitted false return expression
Example 7: Remove file extensions conditionally
Example: Categorize local IP addresses using conditional logic
Related articles
incidr
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Check if IP is in a single CIDR block (match)
Example 2: Check if IP is in a single CIDR block (no match)
Example 3: Check if IP address is in multiple CIDR blocks (logical OR)
Example 4: Exclude IP addresses in multiple CIDR blocks (not incidr)
Related articles
incidr6
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Check against a single IPv6 CIDR
Example 2: Check against multiple IPv6 CIDRs
Related articles
incidrlist
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: All IP addresses in list match the CIDR range
Example 2: Not all IP addresses in list match the CIDR range
Example: Check an array of IP addresses against a CIDR range
Related articles
int_to_ip
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Convert standard positive integer to IPv4
Example 2: Convert negative integer to IPv4
Example 3: Convert zero to IPv4
Example 4: Convert large positive integer to IPv4 (broadcast address)
Related articles
ip_to_int
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a literal IPv4 address string
Example 2: Converting an IPv4 address from a dataset field
Example 3: Handling NULL input
Example 4: Converting a private IPv4 address
Example 5: Converting a public IPv4 address
Related articles
is_ipv4
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Validate IPv4 Addresses in a Dataset
Example 2: Filtering for Valid IPv4 Traffic
Related Articles
is ipv6
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Filter the IPv6 Addresses
Related Articles
is_known_private_ipv4
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Identify Private IPv4 Addresses in a Dataset
Example 2: Filtering for External (Public) IPv4 Traffic
Related Articles
**is_known_private_ipv6**
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Identify Private IPv6 Addresses in a Dataset
Example 2: Filtering for External (Public) IPv6 Traffic
Related Articles
json_extract
Syntax
Syntactic Sugar Format
Parameters
Returns
Usage notes
Examples
Example 1: Basic object property extraction
Regular Syntax
Syntactic Sugar Syntax
Example 2: Extracting a deeper nested object property
Regular Syntax
Syntactic Sugar Syntax
Example 3: Extracting a JSON object from an array using index
Regular Syntax
Syntactic Sugar Syntax
Example 4: Extracting the entire JSON field content (root extraction)
Regular Syntax
Syntactic Sugar Syntax
Example 5: Extraction with a key containing special characters
Regular Syntax
Syntactic Sugar Syntax
Example 6: Handling a path that does not exist
Regular Syntax
Syntactic Sugar Syntax
Example 7: Handling non-JSON formatted string input
Regular Syntax
Syntactic Sugar Syntax
Example 8: Using to_json_string() for explicit type conversion
Regular Syntax
Syntactic Sugar Syntax
Related articles
json_extract_array
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting a root-level JSON array
Example 2: Extracting a nested array with special characters in key
Example 3: Extracting an XQL numeric array converted to JSON string
Example 4: Demonstrating XQL-native array output and element access
Related articles
json_extract_scalar
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting a top-level string scalar value (status)
Example 2: Extracting a numeric scalar value (code) and converting to integer
Example 3: Extracting a nested string scalar value (user.name)
Example 4: Handling special characters in nested key names
Example 5: Attempting to extract an object or array (returns NULL)
Example 6: Handling non-existent paths (returns NULL)
Example 7: Filtering using an XQL-native datatype
Example 8: Filtering using a string
Example 9: Filtering using Syntactic Sugar Format
Related articles
json_extract_scalar_array
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting a scalar array from a nested JSON field (with special characters in path)
Example 2: Extracting an Array of String Tags
Example 3: Extracting a Mixed Scalar Array
Example 4: Extract an array of strings using json_extract_scalar_array
Example 5: Determine the string length using json_extract_scalar_array and array_length
Example 6: Querying normalized network traffic
Example 7: Extracting XDM normalized fields
Related articles
json_path_extract
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting all authors from a nested array
Example 2: Extracting authors with a specific priority
Example 3: Deep scan for all occurrences of a key
Example 4: Extracting all direct properties of an object
Example 5: Deep scan for specific keys
Example 6: Extracting the last element of an array (length calculation)
Example 7: Extracting the last element of an array (slice notation)
Example 8: Extracting elements by specific indices
Example 9: Extracting a slice from the beginning of an array
Example 10: Extract data using different JSONPath expressions
Related articles
lag
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Identify consecutive processes
Related Articles
last
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Identify the last process executed per host
Example 2: Retrieve the last command line for a process
Related Articles
last_value
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: last_value() over an entire partition (default window)
Example 2: last_value() with a rolling window
Example 3: last_value() with a fixed window (current row to end)
Related Articles
latest
Syntax
Parameters
Returns
Usage Notes
Examples
Example 1: Find the latest event ID across the entire dataset
Example 2: Find the latest log entry grouped by success status
Related Articles
least
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Find least among literal values
Example 2: Find least value across multiple fields
Example 3: Implement an upper cap using least
Related articles
len
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculating the length of an existing string field
Example 2: Calculating the length of a literal string
Example 3: Calculating the length of a string derived from a numerical field
Example 4: Calculating the length of a string extracted from JSON data
Example 5: Handling empty strings and NULL values
Related articles
list (comp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Collect all source IPs by destination IP
Example 2: Collect all usernames across all events
Related articles
ln
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate natural logarithm of literal values
Example 2: Calculate natural logarithm from a field value
Example 3: Use natural logarithm for logarithmic scaling
Related articles
log
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate logarithm with different bases
Example 2: Calculate logarithm from a field value
Example 3: Use logarithm for information entropy calculation
Related articles
log10
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate base-10 logarithm of literal values
Example 2: Calculate base-10 logarithm from a field value
Example 3: Use log10 for decibel calculation
Related articles
lowercase
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Lowercasing an existing string field
Example 2: Lowercasing a literal string
Example 3: Lowercasing a string extracted from JSON data
Example 4: Lowercasing a numerical field after explicit string conversion
Example 5: Using lowercase() within a filter stage for case-insensitive matching
Example: Normalize and deduplicate process names
Related articles
ltrim
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Removing leading whitespace (default behavior)
Example 2: Removing a specific exact prefix
Example 3: Removing specific leading characters (character set removal)
Example 4: ltrim() on a string extracted from JSON data
Example 5: ltrim() on a numerical field after explicit string conversion
Example 6: ltrim() on a field with no matching leading characters
Related articles
max (comp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Find the latest event time per host
Example 2: Find the maximum severity across all alerts
Example 3: Multiple aggregations in one comp stage
Related articles
max (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Maximum severity per host (all rows preserved)
Example 2: Running maximum over time
Example 3: Maximum within a sliding window of 3 rows
Related articles
md5
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Hashing a basic literal string
Example 2: Hashing an existing string field
Example 3: Hashing a string derived from a non-string field
Example 4: Hashing an empty string
Example 5: Handling NULL input
Related articles
median (comp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Median response time per endpoint
Example 2: Overall median of bytes received
Related articles
median (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Median bytes per host (all rows preserved)
Example 2: Running median of response times
Related articles
min (comp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Find the earliest event time per host
Example 2: Find the minimum severity across all alerts
Example 3: Multiple aggregations in one comp stage
Related articles
min (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Minimum severity per host (all rows preserved)
Example 2: Running minimum over time
Example 3: Minimum within a sliding window of 3 rows
Related articles
mod
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate modulus of literal values
Example 2: Determine even or odd event IDs
Example 3: Group events into cyclic buckets
Related articles
multiply
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Multiply integer field by integer literal
Example 2: Multiply floating-point field by integer literal
Example 3: Multiply floating-point field by floating-point literal
Example 4: Multiply with a negative integer literal
Example 5: Multiply string-converted-to-number field by integer literal
Related articles
object_create
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Creating an object with string literal key-value pairs
Example 2: Creating an object with mixed data type values (literals)
Example 3: Creating an object with existing field values
Example 4: Creating an object with values from other functions
Example 5: Handling NULL values in object_create()
Related articles
object_merge
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Merging two simple literal objects
Example 2: Merging objects with overlapping keys and new keys
Example 3: Merging objects with values from existing dataset fields
Example 4: Merging objects with values derived from other functions
Example 5: Handling NULL object inputs during merge
Related articles
parse_epoch
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Without a time zone or time unit configured (implicit UTC, seconds)
Example 2: With a time zone configured using an hours offset
Example 3: With a time zone name configured
Example 4: With both time zone and time unit configured
Related articles
parse_timestamp
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Without a time zone configured (implicit UTC)
Example 2: With a time zone configured using an hours offset
Example 3: With a time zone name configured
Example 4: Converting a time string that contains milliseconds
Related articles
pow
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Literal base and literal integer exponent (calculating 1 MB and 1 GB)
Example 2: Field base and literal integer exponent
Example 3: Field base from array and literal integer exponent
Example 4: Literal base and negative integer exponent from array
Example 5: Negative base and literal integer exponent
Example 6: Field base and zero exponent
Example 7: Extracting from JSON and applying pow
Related articles
power
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate power of literal values
Example 2: Square field values using power
Example 3: Calculate square root using power with fractional exponent
Related articles
rand
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Generate random values for each record
Example 2: Random sampling of records
Example 3: Generate random integers in a specific range
Related articles
range_bucket
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Classify values into predefined buckets
Example 2: Classify field values into risk levels
Example 3: Create histogram buckets for duration values
Related articles
rank (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Rank alerts by severity within each host
Example 2: Rank events by time globally
Example 3: Find top-ranked events per category
Related articles
regexcapture
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extracting user and IP address from a login log
Example 2: Extracting process name and file path from an access log
Example 3: Extracting destination IP address, port, and application ID (with case-insensitive matching)
Related articles
regextract
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Extract domain from email address
Example 2: Extract IP address from a log message
Example 3: Extract file extension from file path
Related articles
replace
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Simple replacement of a literal substring
Example 2: Replacing with an empty string (removal)
Example 3: Case-sensitive replacement
Example 4: Combining with lowercase() for case-insensitive replacement logic
Example 5: Replacing a character with another character
Example 6: Handling non-existent substrings
Related articles
replex
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Simple pattern replacement (masking a specific IP address)
Example 2: Using regex character classes for general IP address masking
Example 3: Replacing multiple occurrences of a word
Example 4: Case-insensitive replacement using (?i)
Example 5: Removing a pattern (replacing with an empty string)
Related articles
round
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Round on a positive floating-point field
Example 2: Round on a calculated floating-point value (from an integer field)
Example 3: Round on a negative floating-point value (from an array field)
Example 4: Round on an integer field (no change)
Example 5: Round on a numeric value extracted from JSON data
Related articles
row_number (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Number events chronologically per host
Example 2: Deduplication — keep latest event per host
Example 3: Global row numbering
Related articles
rtrim
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic removal of a common suffix (from dst_domain)
Example 2: Removing trailing whitespace (default behavior)
Example 3: Removing specific characters that repeat at the end
Example 4: Characters to remove not present at the end
Example 5: Case-sensitive nature of trim_characters
Example 6: Trimming a string derived from a JSON field
Example 7: Trimming from an array element converted to string
Related articles
safe_add
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Safe addition of literal values
Example 2: Safe addition of field values
Example 3: Use safe_add with coalesce for fallback
Related articles
safe_divide
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Safe division with zero divisor
Example 2: Calculate safe ratios from field values
Example 3: Use safe_divide with coalesce for fallback
Related articles
safe_multiply
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Safe multiplication of literal values
Example 2: Safe multiplication of field values
Example 3: Use safe_multiply with coalesce for fallback
Related articles
safe_negate
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Negate literal values safely
Example 2: Safely negate field values
Example 3: Use safe_negate to compute absolute difference
Related articles
safe_subtract
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Safe subtraction of literal values
Example 2: Safe subtraction of field values
Example 3: Use safe_subtract with coalesce for fallback
Related articles
sec
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate secant of literal values
Example 2: Calculate secant from a field value
Example 3: Verify secant as reciprocal of cosine
Related articles
sha1
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Hashing a basic literal string
Example 2: Hashing an existing string field
Example 3: Hashing a string derived from a non-string field
Example 4: Hashing an empty string
Example 5: Handling NULL input
Related articles
sha256
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Hashing a basic literal string
Example 2: Hashing an existing string field
Example 3: Hashing a string derived from a non-string field
Example 4: Hashing an empty string
Example 5: Handling NULL input
Related articles
sha512
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Hashing a basic literal string
Example 2: Hashing an existing string field
Example 3: Hashing a string derived from a non-string field
Example 4: Hashing an empty string
Example 5: Handling NULL input
Related articles
sign
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Determine sign of literal values
Example 2: Classify field values by sign
Example 3: Use sign for directional comparison
Related articles
sin
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate sine of literal values
Example 2: Calculate sine from a field value
Example 3: Use sine in a coordinate transformation
Related articles
split
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic split with a specific delimiter
Example 2: Split without a specified delimiter
Example 3: Split with an empty string as delimiter
Example 4: Split on a delimiter not present in the string
Example 5: Split on a field containing NULL values
Example 6: Combining split with arrayindex
Related articles
sqrt
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate square root of literal values
Example 2: Calculate square root from a field value
Example 3: Calculate Euclidean distance using sqrt
Related articles
stddev_population (comp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Standard deviation of response times per host
Example 2: Overall standard deviation of bytes transferred
Example 3: Compare standard deviation with mean
Related articles
stddev_population (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Population standard deviation per host (all rows preserved)
Example 2: Running standard deviation over time
Example 3: Standard deviation within a sliding window
Related articles
stddev_sample (comp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Sample standard deviation of response times per host
Example 2: Overall sample standard deviation
Example 3: Compare population and sample standard deviations
Related articles
stddev_sample (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Sample standard deviation per host (all rows preserved)
Example 2: Running sample standard deviation over time
Example 3: Sample standard deviation within a sliding window
Related articles
string_count
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Counting occurrences of a specific character in a string field
Example 2: Counting occurrences of a substring (word) in a string field
Example 3: Counting delimiters in an IP address string
Example 4: Case-insensitive counting (default behavior)
Example 5: Case-sensitive counting (with config case_sensitive = false)
Example 6: Counting a pattern not present in the string
Example 7: Handling NULL input string
Related articles
subtract
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Subtracting an integer literal from an integer field
Example 2: Subtracting a floating-point literal from a floating-point field
Example 3: Subtracting one field from another field
Example 4: Handling negative numbers (subtracting a negative literal)
Example 5: Subtracting a numeric value extracted from JSON data
Related articles
sum (comp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Total bytes sent per host
Example 2: Total events across all data
Example 3: Sum with multiple aggregations
Related articles
sum (windowcomp)
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Cumulative bytes sent over time
Example 2: Total bytes per host (all rows preserved)
Example 3: Moving sum within a sliding window
Related articles
tan
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calculate tangent of literal values
Example 2: Calculate tangent from a field value
Example 3: Calculate slope angle from rise and run
Related articles
time_frame_end
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: With a relative timeframe (last N units)
Example 2: With a relative timeframe (between relative start and "now")
Example 3: With an exact timeframe
Related articles
timestamp_diff
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Difference in seconds between current_time() and_time
Example 2: Difference in minutes between _time and a static timestamp
Example 3: Difference in hours, yielding a negative result
Example 4: Using timestamp_diff() in a filter stage
Example 5: Difference in milliseconds between _time and a closely past static timestamp
Related articles
timestamp_seconds
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a literal epoch second integer
Example 2: Converting an integer field to a timestamp
Example 3: Converting a derived integer from a JSON field to a timestamp
Example 4: Handling NULL input
Related articles
to_boolean
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a literal string "TRUE"
Example 2: Converting a literal string "FALSE"
Example 3: Converting a case-insensitive literal string
Example 4: Converting a derived string field
Example 5: Handling invalid string input
Example 6: Using supported operators for deriving a boolean string
Related articles
to_epoch
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting _time (timestamp field) to epoch in seconds
Example 2: Converting _time (timestamp field) to epoch in milliseconds
Example 3: Converting _time (timestamp field) to epoch in microseconds
Example 4: Converting a string timestamp to epoch
Related articles
to_float
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a literal string (decimal representation) to float
Example 2: Converting a literal string (integer representation) to float
Example 3: Converting a string extracted from JSON to float
Example 4: Converting an integer field (via to_string()) to float
Example 5: Handling non-numeric string input (returns NULL)
Related articles
to_integer
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a literal integer string to integer
Example 2: Converting a literal floating-point string to integer
Example 3: Converting a numeric string from an existing field to integer
Example 4: Converting a string extracted from JSON to integer
Example 5: Handling non-numeric string input
Example 6: Using to_integer() in a filter stage
Related articles
to_json_string
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a string field
Example 2: Converting a numeric field (integer)
Example 3: Converting a numeric field (float)
Example 4: Converting a boolean field
Example 5: Converting a JSON object field to a JSON string
Example 6: Converting an array of JSON objects field to a JSON string
Related articles
to_number
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a literal integer string
Example 2: Converting a literal floating-point string
Example 3: Converting a numeric string extracted from a JSON field
Example 4: Attempting to convert a string with non-numeric characters
Example 5: Converting a NULL input field
Related articles
to_string
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a numeric (integer) field
Example 2: Converting a numeric (float) field
Example 3: Converting a boolean field
Example 4: Converting a literal numeric value
Example 5: Using to_string() in a filter condition
Example 6: Handling NULL input field
Related articles
to_timestamp
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Converting a numeric field to a timestamp (default seconds unit)
Example 2: Converting a numeric field to a timestamp (explicit seconds unit)
Example 3: Converting a literal integer to a timestamp (milliseconds unit)
Example 4: Converting a literal integer to a timestamp (microseconds unit)
Example 5: Converting a derived integer from an array field to a timestamp (milliseconds unit)
Example 6: Handling NULL input
Related articles
trim
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Removing leading and trailing whitespace (default behavior)
Example 2: Removing specific characters from both ends
Example 3: Removing multiple specific characters
Related articles
trunc
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Truncate literal values to different precisions
Example 2: Truncate field values to integer
Example 3: Truncate with negative decimal places
Example 4: Compare trunc with round and floor for negative numbers
Related articles
uppercase
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: uppercase() on a direct string field
Example 2: uppercase() on a string field (for example, Domain Name)
Example 3: uppercase() used in conjunction with filter
Example 4: uppercase() on an extracted JSON string field
Example 5: uppercase() within arraymap() for an array of Strings
Related articles
values
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Distinct source IPs per destination
Example 2: All unique usernames across events
Example 3: Distinct event types per host
Related articles
var
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Variance of response times per host
Example 2: Overall variance of bytes transferred
Example 3: Variance with mean and standard deviation
Related articles
wildcard_match
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic wildcard matching with *
Example 2: Wildcard matching with ?
Example 3: Complex pattern with * and ?
Example 4: Case-insensitive matching
Related articles
Stages
alter
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Creating a new field with a constant value
Example 2: Creating a new field based on an existing field
Example 3: Modifying an existing field
Example 4: Using string manipulation functions (concat)
Example 5: Using string manipulation functions (lowercase)
Example 6: Using string manipulation functions (split)
Example 7: Using JSON functions (json_extract_scalar)
Example 8: Using JSON functions (json_extract_array)
Example 9: Using conditional and null handling functions (if)
Example 10: Using conditional and null handling functions (coalesce)
Example 11: Using time functions (format_timestamp)
Example 12: Using mathematical functions (add)
Example 13: Using mathematical functions (multiply)
Example 14: Using mathematical functions (divide)
Example 15: Using array functions (arraycreate)
Example 16: Using array functions (arraymap)
Example 17: Using array functions (arrayrange)
Related articles
arrayexpand
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic arrayexpand on a simple array
Example 2: arrayexpand with limit
Example 3: arrayexpand followed by sort
Example 4: arrayexpand on an array of JSON objects
Related articles
bin
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Binning by time
Example 2: Binning numeric values
Related articles
call
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Calling a saved query
Example 2: Reusing data preparation logic
Related articles
comp
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic Counting
Example 2: Multiple Aggregations
Example 3: Grouping by Time (after Binning)
Example 4: Collecting Unique Values
Related articles
config
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Case-sensitive search
Example 2: Case-insensitive search
Example 3: Relative time (simple duration)
Example 4: Relative time (range ending now)
Example 5: Relative time (from beginning to past offset)
Example 6: Relative time (between two offsets)
Example 7: Exact timeframe
Related articles
dataset
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic Dataset Specification
Example 2: Specifying Multiple Datasets
Example 3: cold_dataset Note (conceptual example)
Example 4: Default dataset (xdr_data)
Related articles
dedup
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic dedup on a single field
Example 2: Dedup by earliest time
Example 3: Dedup by latest time
Example 4: Dedup on multiple fields
Example 5: Dedup on multiple fields with a by clause
Related articles
fields
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic field selection
Example 2: Aliasing fields
Example 3: Including fields with wildcards
Example 4: Excluding fields
Related articles
filter
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Comparison operator - equals (=)
Example 2: Comparison operator - not equal to (!=)
Example 3: Comparison operator -less than (<)
Example 4: Comparison operator - less than or equal to (<=)
Example 5: Comparison operator - greater than (>)
Example 6: Comparison operator - greater than or equal to (>=)
Example 7: Boolean operator - AND (and)
Example 8: Boolean operator - OR (or)
Example 9: Boolean operator - NOT (not)
Example 10: Boolean operator - parentheses grouping
Example 11: String operator - IN (in)
Example 12: String operator - NOT IN (not in)
Example 13: String operator - contains
Example 14: Regular expression match (~=)
Example 15: Regular expression does not match (!~=)
Example 16: Range operator - incidr (IPv4)
Example 17: Range operator - not incidr (IPv4)
Example 18: Range operator - incidr6 (IPv6)
Example 19: Range operator - not incidr6 (IPv6)
Example 20: Null value filtering (AND)
Example 21: Null value filtering (NOT IN)
Example 22: String manipulation - single quotes
Example 23: String manipulation - triple quotes
Example 24: Subquery filtering - IN
Example 25: Subquery filtering - NOT IN
Related articles
iploc
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic iploc (default geolocation fields)
Example 2: Specifying selected geolocation fields
Example 3: Aliasing geolocation fields
Example 4: Viewing iploc results as a map graph
Related articles
join
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Inner join
Example 2: Left join
Example 3: Right join
Example 4: Conflict strategy left
Example 5: Conflict strategy right
Related articles
limit
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic limit to restrict total records
Example 2: Limit after a filter stage
Example 3: Limit after a sort stage
Example 4: Limit after comp (aggregation)
Related articles
preset
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Authentication story preset
Example 2: Network story preset
Example 3: XDR event log preset
Example 4: XDR file preset
Example 5: Host inventory users preset
Example 6: Host inventory shares preset
Example 7: Host users to groups preset
Example 8: Device control preset
Related articles
replacenull
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic replacenull on an existing field with nulls
Example 2: replacenull on a field derived from a JSON function
Example 3: Filtering based on the replaced value
Related articles
search
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic free-text search across default datasets
Example 2: Free-text search within a specific dataset
Example 3: Searching for multiple free-text strings
Example 4: Using config timeframe with search
Related articles
sort
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Single field sort (ascending)
Example 2: Single field sort (descending)
Example 3: Multiple field sort
Example 4: Numeric conversion sort
Related articles
tag
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Adding a single tag to records
Example 2: Adding a list of tags to records
Related articles
target
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Create new dataset (implicit append)
Example 2: Explicitly creating a new dataset (append=false)
Example 3: Appending to an existing dataset (append=true)
Example 4: Creating a lookup table (type=lookup)
Related articles
top
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic top stage example
Example 2: Top stage with by clause
Example 3: Top stage with custom column names
Related articles
transaction
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Basic transaction grouping
Example 2: Transaction with time span
Example 3: Transaction with timeshift and timezone
Example 4: Transaction with start and end conditions
Example 5: Transaction with max events limit
Related articles
union
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Union with a named dataset
Example 2: Union with an Inner XQL Query
Related articles
view
Syntax
Parameters
Returns
Usage notes
Examples
Example 1: Highlighting specific values
Example 2: Visualizing categorical data (Pie chart)
Example 3: Trend analysis (column graph)
Example 4: Adding granularity to graphs (series)
Example 5: Prioritizing display (column order)
Related articles
windowcomp
Syntax
Alternative syntax (using over() clause)
Parameters
Returns
Usage notes
Supported functions
Aggregate functions
Statistical functions
Ranking functions
Navigation functions
Examples
Example 1: Rolling average over a partition
Example 2: Rolling window with between clause
Example 3: Counting rows in a partition
Example 4: Running maximum over time
Example 5: Cumulative sum (running total)
Example 6: Row numbering within partitions
Example 7: Ranking with gaps
Example 8: Fixed window (current row to end of partition)
Example 9: Sliding window maximum
Example 10: First value with over() syntax
Example 11: Filtering by bank (top-n per group)
Related articles

Back to home page