Functions
XQL functions run inside stages and return a value. Use this section to: * [Start with the overview](functions/index) * [Scan the full function index](functions/functions-list) * [Jump to JSON functions](functions/json_functions_reference)
Sub-topics
- Functions overview
- Functions list
- acos
- add
- approx_count
- approx_quantiles
- approx_top
- array_all
- array_any
- array_length
- arrayconcat
- arraycreate
- arraydistinct
- arrayfilter
- arrayindex
- arrayindexof
- arraymap
- arraymerge
- arrayrange
- arraystring
- asin
- avg (comp)
- avg (windowcomp)
- bitwise_and
- bitwise_or
- bitwise_sleft
- bitwise_sright
- bitwise_xor
- cbrt
- ceil
- coalesce
- concat
- convert_from_base_64
- convert_to_base_64
- cos
- cosine_distance
- cot
- count_distinct
- count (comp)
- count (windowcomp)
- csc
- current_time
- date_floor
- div
- divide
- earliest
- euclidean_distance
- exp
- extract_time
- extract_url_host
- extract_url_pub_suffix
- extract_url_registered_domain
- first
- first_value
- floor
- format_string
- format_timestamp
- greatest
- hierarchy_match
- if
- incidr
- incidr6
- incidrlist
- int_to_ip
- ip_to_int
- is_ipv4
- is_ipv6
- is_known_private_ipv4
- is_known_private_ipv6
- json_extract
- json_extract_array
- json_extract_scalar
- json_extract_scalar_array
- XQL JSON Functions Reference
- json_path_extract
- lag
- last
- last_value
- latest
- least
- len
- list (comp)
- ln
- log
- log10
- lowercase
- ltrim
- max (comp)
- max (windowcomp)
- md5
- median (comp)
- median (windowcomp)
- min (comp)
- min (windowcomp)
- mod
- multiply
- object_create
- object_merge
- parse_epoch
- parse_timestamp
- pow
- power
- rand
- range_bucket
- rank (windowcomp)
- regexcapture
- regextract
- replace
- replex
- round
- row_number (windowcomp)
- rtrim
- safe_add
- safe_divide
- safe_multiply
- safe_negate
- safe_subtract
- sec
- sha1
- sha256
- sha512
- sign
- sin
- split
- sqrt
- stddev_population (comp)
- stddev_population (windowcomp)
- stddev_sample (comp)
- stddev_sample (windowcomp)
- string_count
- subtract
- sum (comp)
- sum (windowcomp)
- tan
- time_frame_end
- timestamp_diff
- timestamp_seconds
- to_boolean
- to_epoch
- to_float
- to_integer
- to_json_string
- to_number
- to_string
- to_timestamp
- trim
- trunc
- uppercase
- values
- var
- wildcard_match