Stages list ↗

The following table lists all available XQL pipeline stages:

Stage	Description
`alter`	Manipulate data by changing existing field values or creating new fields
`arrayexpand`	Expand an array field into multiple rows
`bin`	Group numeric values into bins
`call`	Call a saved XQL query
`comp`	Aggregate data using grouping and aggregate functions
`config`	Configure query settings
`dataset`	Specify the dataset to query
`dedup`	Remove duplicate rows
`fields`	Select or exclude specific fields
`filter`	Filter rows based on a condition
`iploc`	Enrich IP addresses with geolocation data
`join`	Join two datasets
`limit`	Limit the number of rows returned
`pivot`	Rotate row-level data into columns using aggregate functions
`preset`	Apply preset configurations
`replacenull`	Replace null values with a specified value
`search`	Search for records matching a text query
`sort`	Sort rows by one or more fields
`tag`	Add tags to query results
`target`	Specify the target output for query results
`top`	Return the top N rows by a specified field
`transaction`	Group events into transactions
`transpose`	Transpose rows into columns
`union`	Combine the results of two or more queries
`view`	Query a saved view
`windowcomp`	Perform analytic (window) functions over a defined window of rows without collapsing the dataset

Stage	Description
`alter`	Manipulate data by changing existing field values or creating new fields
`arrayexpand`	Expand an array field into multiple rows
`bin`	Group numeric values into bins
`call`	Call a saved XQL query
`comp`	Aggregate data using grouping and aggregate functions
`config`	Configure query settings
`dataset`	Specify the dataset to query
`dedup`	Remove duplicate rows
`fields`	Select or exclude specific fields
`filter`	Filter rows based on a condition
`iploc`	Enrich IP addresses with geolocation data
`join`	Join two datasets
`limit`	Limit the number of rows returned
`pivot`	Rotate row-level data into columns using aggregate functions
`preset`	Apply preset configurations
`replacenull`	Replace null values with a specified value
`search`	Perform free-text searches across ingested data
`sort`	Sort rows by one or more fields
`tag`	Add tags to query results
`target`	Specify the target output for query results
`top`	Return the top N rows by a specified field
`transaction`	Group events into transactions
`transpose`	Transpose rows into columns
`union`	Combine the results of two or more queries
`view`	Query a saved view
`windowcomp`	Perform analytic (window) functions over a defined window of rows without collapsing the dataset