sha512 ↗

Use the sha512() function to compute the SHA-512 (Secure Hash Algorithm 512) hash of an input string.

Syntax

sha512 ("<input_string>")

Parameters

Name Type Required Description
<input_string> string Yes The string value to be hashed.

Returns

The sha512() function returns the SHA-512 hash value as a string.

Usage notes

  • The function strictly requires a single string input.
  • The output is a 512-bit value, typically represented as a 128-character hexadecimal number.
  • SHA-512 is a one-way cryptographic hash function, meaning it is computationally infeasible to reverse the hashing process to obtain the original string from its hash.
  • If the input string is NULL, the function returns NULL.

Examples

Example 1: Hashing a basic literal string

Goal: Compute the SHA-512 hash of a simple literal string.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_literal = sha512("Hello XQL Functions!")
| fields event_id, hashed_literal
| limit 3

Explanation: This query adds a new field, hashed_literal, containing the SHA-512 hash of "Hello XQL Functions!" for each record.

Output:

EVENT_ID HASHED_LITERAL
101 cb8e63a35f7c320d778a3c861e967a5b3a4a7c8e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b
102 cb8e63a35f7c320d778a3c861e967a5b3a4a7c8e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b
103 cb8e63a35f7c320d778a3c861e967a5b3a4a7c8e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b

Example 2: Hashing an existing string field

Goal: Hash the values of an existing string field in the dataset.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_description = sha512(event_description)
| fields event_id, event_description, hashed_description
| limit 3

Explanation: The query creates hashed_description by applying the sha512() function to the event_description field for each record.

Output:

EVENT_ID EVENT_DESCRIPTION HASHED_DESCRIPTION
101 User login successful e1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4
102 File access attempt f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2
103 Network connection established a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4

Example 3: Hashing a string derived from a non-string field

Goal: Convert a numeric field to a string and then hash it.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter event_id_string = to_string(event_id)
| alter hashed_id = sha512(event_id_string)
| fields event_id, event_id_string, hashed_id
| limit 3

Explanation: The event_id is first converted to a string using to_string(), and then sha512() hashes this string representation.

Output:

EVENT_ID EVENT_ID_STRING HASHED_ID
101 101 22340356a64b5687790b0e51d45371b2d424075191a385f269a84d4128f6412f11181827457c134012019c4d93e5482329239d57a4141d63e9f425c2763b
102 102 00d4187c29377a06a096c1410f994784407850a116b0b001a4e107f7b3a4a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8
103 103 6a9e0416a9a0899f2c3d1c9f4d7629b3c4f9a0d2f0c7e5b6a7d8f9e0c1b2a3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4

Example 4: Hashing an empty string

Goal: Demonstrate the result of hashing an empty string.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_empty_string = sha512("")
| fields event_id, hashed_empty_string
| limit 3

Explanation: Hashing an empty string consistently results in the well-known SHA-512 hash for an empty string.

Output:

EVENT_ID HASHED_EMPTY_STRING
101 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
102 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
103 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Example 5: Handling NULL input

Goal: Demonstrate the behavior when the input string is NULL.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_null_field = sha512(dst_domain)
| fields event_id, dst_domain, hashed_null_field
| limit 5

Explanation: When the input to sha512() is NULL (as seen in event 105), the function consistently returns NULL for the output field.

Output:

EVENT_ID DST_DOMAIN HASHED_NULL_FIELD
101 ec2.amazonaws.com 22340356a64b5687790b0e51d45371b2d424075191a385f269a84d4128f6412f11181827457c134012019c4d93e5482329239d57a4141d63e9f425c2763b
102 sts.amazonaws.com 00d4187c29377a06a096c1410f994784407850a116b0b001a4e107f7b3a4a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8
103 www.google.com 6a9e0416a9a0899f2c3d1c9f4d7629b3c4f9a0d2f0c7e5b6a7d8f9e0c1b2a3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4
104 dropbox.com f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2
105 NULL NULL