Functions list ↗

The following table lists all available XQL functions:

Function Description
acos Calculate the inverse cosine (arccosine) of a numerical expression
add Calculate the sum of two numbers
approx_count Return an approximate count of distinct values
approx_quantiles Return approximate quantile boundaries
approx_top Return the approximate top values
asin Calculate the inverse sine (arcsine) of a numerical expression
array_all Check if all elements in an array match a condition
array_any Check if any element in an array matches a condition
array_length Return the number of elements in an array
arrayconcat Concatenate two arrays
arraycreate Create an array from a list of values
arraydistinct Return an array with duplicate values removed
arrayfilter Filter elements of an array based on a condition
arrayindex Return the element at a specified index in an array
arrayindexof Return the index of a value in an array
arraymap Apply a function to each element of an array
arraymerge Merge multiple arrays into one
arrayrange Create an array of sequential integers
arraystring Convert an array to a string
avg (with comp stage) Calculate the average value using the comp stage
avg (with windowcomp stage) Calculate the average value using the windowcomp stage
bitwise_and Perform a bitwise AND operation between two integer values
bitwise_or Perform a bitwise OR operation between two integer values
bitwise_sleft Perform a bitwise left shift operation on an integer value
bitwise_sright Perform a bitwise right shift operation on an integer value
bitwise_xor Perform a bitwise exclusive OR (XOR) operation between two integer values
cbrt Calculate the cube root of a numeric value
ceil Round a number up to the nearest integer
coalesce Return the first non-null value from a list
concat Concatenate two or more strings
convert_from_base_64 Decode a Base64-encoded string
convert_to_base_64 Encode a string to Base64
cos Calculate the cosine of a numeric value specified in radians
cosine_distance Calculate the cosine distance between two numeric vectors
cot Calculate the cotangent of a numeric value specified in radians
count (with comp stage) Count values using the comp stage
count (with windowcomp stage) Count values using the windowcomp stage
count_distinct Count distinct values
csc Calculate the cosecant of a numeric value specified in radians
current_time Return the current timestamp
date_floor Round a timestamp down to a specified time unit
divide Divide one number by another
earliest Return the earliest timestamp value
euclidean_distance Calculate the Euclidean distance between two numeric vectors
exp Calculate the value of e raised to the power of a numeric value
extract_time Extract a time component from a timestamp
extract_url_host Extract the host from a URL
extract_url_pub_suffix Extract the public suffix from a URL
extract_url_registered_domain Extract the registered domain from a URL
first Return the first value in a group
first_value Return the first value in a window
floor Round a number down to the nearest integer
format_string Format a string using a template
format_timestamp Format a timestamp as a string
greatest Return the largest value from a list of expressions
hierarchy_match Check whether an asset belongs to an organizational hierarchy node
if Return one of two values based on a condition
incidr Check if an IPv4 address is within a CIDR range
incidr6 Check if an IPv6 address is within a CIDR range
incidrlist Check if an IP address is within a list of CIDR ranges
int_to_ip Convert an integer to an IP address string
ip_to_int Convert an IP address string to an integer
is_ipv4 Check if a value is a valid IPv4 address
is_ipv6 Check if a value is a valid IPv6 address
is_known_private_ipv4 Check if an IPv4 address is a known private address
is_known_private_ipv6 Check if an IPv6 address is a known private address
json_extract Extract a value from a JSON string
json_extract_array Extract an array from a JSON string
json_extract_scalar Extract a scalar value from a JSON string
json_extract_scalar_array Extract a scalar array from a JSON string
json_path_extract Extract a value from a JSON string using a JSONPath expression
json_functions_reference Decide which JSON functions to use
lag Return the value of a field from a previous row in a window
last Return the last value in a group
last_value Return the last value in a window
latest Return the latest timestamp value
least Return the smallest value from a list of expressions
len Return the length of a string or array
list (with comp stage) Collect all values of a field and return them as an array within the comp stage
ln Calculate the natural logarithm (base e) of a numeric value
log Calculate the logarithm of a numeric value with a specified base
log10 Calculate the base-10 logarithm of a numeric value
lowercase Convert a string to lowercase
ltrim Remove leading whitespace from a string
max (with comp stage) Return the maximum value of a field within the comp stage
max (with windowcomp stage) Compute the maximum value of a field over a window of rows within the windowcomp stage
md5 Calculate the MD5 hash of a string
median (with comp stage) Return the median value of a numeric field within the comp stage
median (with windowcomp stage) Compute the median value of a numeric field over a window of rows within the windowcomp stage
min (with comp stage) Return the minimum value of a field within the comp stage
min (with windowcomp stage) Compute the minimum value of a field over a window of rows within the windowcomp stage
mod Calculate the remainder (modulus) of the division of two numeric values
multiply Multiply two numbers
object_create Create a JSON object from key-value pairs
object_merge Merge two JSON objects
parse_epoch Parse an epoch timestamp
parse_timestamp Parse a timestamp string
pow Raise a number to a power
power Raise a number to the power of another number (alias for pow)
rand Generate a pseudo-random floating-point number between 0 and 1
range_bucket Determine which bucket a numeric value falls into given an array of boundaries
rank (with windowcomp stage) Assign a rank to each row within a partition in the windowcomp stage
regexcapture Extract substrings using a regular expression
regextract Extract a substring from a field value using a regular expression pattern
replace Replace occurrences of a substring
replex Replace substrings using a regular expression
round Round a number to a specified number of decimal places
row_number (with windowcomp stage) Assign a unique sequential integer to each row within a partition in the windowcomp stage
rtrim Remove trailing whitespace from a string
safe_add Perform addition with overflow protection, returning null on overflow
safe_divide Perform division with error protection, returning null on division by zero
safe_multiply Perform multiplication with overflow protection, returning null on overflow
safe_negate Negate a numeric value with overflow protection, returning null on overflow
safe_subtract Perform subtraction with overflow protection, returning null on overflow
sec Calculate the secant of a numeric value specified in radians
sha1 Calculate the SHA-1 hash of a string
sha256 Calculate the SHA-256 hash of a string
sha512 Calculate the SHA-512 hash of a string
sign Determine the sign of a numeric value (-1, 0, or 1)
sin Calculate the sine of a numeric value specified in radians
split Split a string into an array
sqrt Calculate the square root of a numeric value
stddev_population (with comp stage) Compute the population standard deviation of a numeric field within the comp stage
stddev_population (with windowcomp stage) Compute the population standard deviation of a numeric field over a window of rows within the windowcomp stage
stddev_sample (with comp stage) Compute the sample standard deviation of a numeric field within the comp stage
stddev_sample (with windowcomp stage) Compute the sample standard deviation of a numeric field over a window of rows within the windowcomp stage
string_count Count occurrences of a substring in a string
subtract Subtract one number from another
sum (with comp stage) Compute the sum of a numeric field within the comp stage
sum (with windowcomp stage) Compute the sum of a numeric field over a window of rows within the windowcomp stage
tan Calculate the tangent of a numeric value specified in radians
time_frame_end Return the end of a time frame
timestamp_diff Calculate the difference between two timestamps
timestamp_seconds Convert a timestamp to seconds
to_boolean Convert a value to a boolean
to_epoch Convert a timestamp to an epoch value
to_float Convert a value to a float
to_integer Convert a value to an integer
to_json_string Convert a value to a JSON string
to_number Convert a value to a number
to_string Convert a value to a string
to_timestamp Convert a value to a timestamp
trim Remove leading and trailing whitespace from a string
trunc Truncate a numeric value to a specified number of decimal places
uppercase Convert a string to uppercase
values Collect all distinct values of a field and return them as an array within the comp stage
var Compute the variance of a numeric field within the comp stage
wildcard_match Check if a string matches a wildcard pattern