Functions

Functions are used in eval, stats, and where expressions. In signatures, T means the return type matches the argument; number is numeric; string is text.

Usage

… | eval new_field = lower(username)
… | stats count() as total, avg(bytes) by src_ip
… | where like(host, "web%")

Comparison operators = != < <= > >= support string/integer mixed comparison.

Conditional and null

Function	Signature	Description
`if`	`if(boolean, T, T) -> T`	If true, second arg; else third
`ifnull`	`ifnull(T, T) -> T`	If first is null, return second
`isnull`	`isnull(T) -> integer`	Null test
`isnotnull`	`isnotnull(T) -> boolean`	Non-null test
`is null` / `is not null`	predicate form	Predicate equivalents
`nullif`	`nullif(T, T) -> T`	Null if equal; else first
`cidrmatch`	`cidrmatch(ip, cidr) -> boolean`	IP in CIDR
`like`	`like(text, pattern) -> boolean`	Pattern match; `%` multi, `_` single
`not like`	`not like(text, pattern) -> boolean`	Pattern does not match

… | eval err = if(status == 200, "OK", "Error")
… | where like(field, "foo%")
… | where cidrmatch(src_ip, "10.0.0.0/8")

Trigonometric

Function	Signature	Description
`acos`	`acos(number) -> double`	Inverse cosine
`asin`	`asin(number) -> double`	Inverse sine
`atan`	`atan(number) -> double`	Inverse tangent
`atan2`	`atan2(number, number) -> double`	Two-argument arctangent
`cos`	`cos(number) -> double`	Cosine
`cot`	`cot(number) -> double`	Cotangent
`sin`	`sin(number) -> double`	Sine
`tan`	`tan(number) -> double`	Tangent
`degrees`	`degrees(number) -> double`	Radians to degrees
`radians`	`radians(number) -> double`	Degrees to radians

Date and time

Function	Signature	Description
`adddate`	`adddate(date, INTERVAL expr unit) -> date`	Add interval
`subdate`	`subdate(date, INTERVAL expr unit) -> date`	Subtract interval
`date_add`	`date_add(date, INTERVAL expr unit) -> date`	Same as add
`date_sub`	`date_sub(date, INTERVAL expr unit) -> date`	Same as subtract
`now`	`now() -> datetime`	Current timestamp
`date`	`date(expr) -> date`	Date part
`time`	`time(expr) -> time`	Time part
`timestamp`	`timestamp(date) -> timestamp`	Cast to timestamp
`date_format`	`date_format(date, string) -> string`	Format string
`day` / `dayofmonth`	`dayofmonth(date) -> integer`	Day of month (1–31)
`dayname`	`dayname(date) -> string`	Weekday name
`dayofweek`	`dayofweek(date) -> integer`	Weekday number
`dayofyear`	`dayofyear(date) -> integer`	Day of year
`month`	`month(date) -> integer`	Month
`monthname`	`monthname(date) -> string`	Month name
`quarter`	`quarter(date) -> integer`	Quarter
`week`	`week(date[, mode]) -> integer`	Week number
`year`	`year(date) -> integer`	Year
`hour`	`hour(time) -> integer`	Hour
`minute`	`minute(expr) -> integer`	Minute
`second`	`second(time) -> integer`	Second
`microsecond`	`microsecond(expr) -> integer`	Microsecond
`time_to_sec`	`time_to_sec(time) -> long`	Time to seconds
`to_days`	`to_days(date) -> long`	Date to day number
`from_days`	`from_days(N) -> date`	Day number to date
`interval`	`INTERVAL expr unit`	Interval literal

Statistical (`stats`)

Function	Signature	Description
`count`	`count([field]) -> long`	Count
`sum`	`sum(number) -> number`	Sum
`avg`	`avg(number) -> number`	Average
`min`	`min(field) -> field`	Minimum
`max`	`max(field) -> field`	Maximum
`values`	`values(field) -> multivalue`	Distinct values
`earliest`	`earliest(field) -> field`	Earliest-side aggregate; prefer `sort _time` first
`latest`	`latest(field) -> field`	Latest-side aggregate; prefer `sort _time` first
`var_pop` / `variance`	`var_pop(number) -> double`	Population variance
`var_samp`	`var_samp(number) -> double`	Sample variance
`stddev_pop` / `std` / `stddev`	`stddev_pop(number) -> double`	Population stddev
`stddev_samp`	`stddev_samp(number) -> double`	Sample stddev

index="unix"
| sort _time
| stats count() as total, earliest(src_ip) as first_ip, latest(action) as last_action by user

Math

Function	Signature	Description
`abs`	`abs(number) -> number`	Absolute value
`ceil` / `ceiling`	`ceil(number) -> number`	Ceiling
`floor`	`floor(number) -> number`	Floor
`round`	`round(number) -> number`	Round
`truncate`	`truncate(number, number) -> number`	Truncate decimals
`exp`	`exp(number) -> number`	e^x
`ln`	`ln(number) -> double`	Natural log
`log`	`log(number) -> double` or `log(number, number) -> double`	Logarithm
`log2`	`log2(number) -> double`	Base-2 log
`log10`	`log10(number) -> double`	Base-10 log
`pow` / `power`	`pow(number, number) -> number`	Power
`sqrt`	`sqrt(number) -> number`	Square root
`mod`	`mod(number, number) -> number`	Modulo
`pi`	`pi() -> double`	π
`e`	`e() -> double`	e
`rand`	`rand() -> number` or `rand(number) -> number`	Random
`sign`	`sign(number) -> number`	Sign
`conv`	`conv(string, int, int) -> string`	Base conversion
`crc32`	`crc32(string) -> number`	CRC32

Arithmetic operators: + - * / %.

Text

Function	Signature	Description
`tostring`	`tostring(value[, format]) -> string`	To string; numbers may use `hex` / `commas` / `duration`
`lower`	`lower(string) -> string`	Lowercase
`upper`	`upper(string) -> string`	Uppercase
`trim`	`trim(string) -> string`	Trim both ends
`ltrim`	`ltrim(string) -> string`	Trim left
`rtrim`	`rtrim(string) -> string`	Trim right
`concat`	`concat(str1, str2, ...) -> string`	Concatenate
`concat_ws`	`concat_ws(sep, string, ...) -> string`	Concatenate with separator
`substr` / `substring`	`substring(string, int[, int]) -> string`	Substring
`left`	`left(string, int) -> string`	Left slice
`right`	`right(string, int) -> string`	Right slice
`length`	`length(string) -> integer`	Length
`locate`	`locate(substr, string[, pos]) -> integer`	Find position
`replace`	`replace(string, from, to) -> string`	Replace
`ascii`	`ascii(string) -> integer`	First-character ASCII
`strcmp`	`strcmp(string, string) -> integer`	String compare
`regexp`	`regexp(...)`	Regex helpers

… | eval lowuser = lower(username)
… | eval n = tostring(bytes, "commas")

Multivalue

Function	Signature	Description
`mvindex`	`mvindex(mv, integer) -> value`	Element at index

Often used with makemv / mvexpand / mvcombine.

Window

Function	Signature	Description
`row_number`	`row_number() -> integer`	Row number in partition
`rank`	`rank() -> integer`	Rank (ties may skip)
`dense_rank`	`dense_rank() -> integer`	Dense rank

The engine provides converters such as cast_to_string, cast_to_int, cast_to_long, cast_to_double, cast_to_boolean, cast_to_date, cast_to_time, cast_to_timestamp, and cast_to_datetime. Pick the target type you need.

Functions

Functions

Usage

Conditional and null

Trigonometric

Date and time

Statistical (`stats`)

Math

Text

Multivalue

Window

Type conversion

On this page