Skip to content
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

## `table()`

The `table()` function displays query results in a table, allowing to specify the list of fields to include in the table.

The `table()` function is an aggregate function and does as follows:

- Sorts columns in the table based on specified field order.

- Aggregates events based on the `limit` parameter. It will limit the number of events returned using the `limit` parameter.

- Sorts results according to the `sortby` parameter.

For large data exports, consider using the `select()` function instead. The `select()` function provides similar tabular output but without row limits or sorting constraints in streaming queries. For standard queries, the implied `tail(200)` would be applied.

Parameter | Type | Required | Default Value | Description
--- | --- | --- | --- | ---
`fields`[a] | array of strings | required |  | The names of the fields to select.
`limit` | number | optional[b] | `200` | The argument given to this parameter determines the limit on the number of rows included in the result of the function. The maximum is controlled by the `StateRowLimit` dynamic configuration, which is `StateRowLimit` by default. If the argument is `max` (`limit=max`), then the value of `StateRowLimit` is used.
|  | Controlling Variables
|  | `StateRowLimit` |
`order` | array of strings | optional[b] | `desc` | Order to sort in.
|  |  | Values
|  |  | `asc` | Ascending (A-Z, 0-9) order
|  |  | `desc` | Descending (Z-A, 9-0) order
`reverse` | boolean | optional[b] |  | Whether to sort in descending order. Deprecated: prefer `order` instead.
`sortby` | array of strings | optional[b] | `@timestamp` | Names of fields to sort by.
`type` | array of strings | optional[b] | `number` | Type of the fields to sort.
|  |  | Values
|  |  | `any` | Any fields. (deprecated in 1.125)
|  |  | `hex` | Hexadecimal fields
|  |  | `number` | Numerical fields
|  |  | `string` | String fields
[a] The parameter name `fields` can be omitted. [b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

> Omitted Argument Names

> The argument name for `fields` can be omitted; the following forms of this function are equivalent:

> logscale Syntax

>     table(["value"])

> and:

> logscale Syntax

>     table(fields=["value"])

> These examples show basic structure only.

### `table()` Syntax Examples

Create a table of HTTP GET methods displaying the fields statuscode and responsetime:

logscale

    method=GET
    | table([statuscode, responsetime])

Display the 50 slowest requests by name and responsetime:

logscale

    table([name, responsetime], sortby=responsetime, limit=50, order=asc)

### `table()` Examples

Click + next to an example below to get the full details.

#### Calculate Query Costs by User and Repository in a Single Field

Calculate query costs by user across multiple repositories, showing the repository/user as a single field

##### Query

logscale

    #type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob message="Highest Cost query"
    | repoUser:= format("%s/%s", field=[dataspace, initiatingUser])
    | top(repoUser, sum=deltaTotalCost, as=cost)
    |table([cost, repoUser], sortby=cost)

##### Introduction

In this example, the query filter events in the humio repository that are tagged with `kind` equal to `logs` and then returns the events where the class field has values containing `c.h.j.RunningQueriesLoggerJob`, searching for the specific value `Highest Cost query`. The query then combines the results in a new field repoUser. The query then uses `top()` and `table()` functions to aggregate and display the results.

Example incoming data might look like this:

#type | #kind | class | message | timestamp | dataspace | initiatingUser | totalLiveCost | totalStaticCost | deltaTotalCost | repo
--- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---
humio | logs | c.h.j.RunningQueriesLoggerJob | Highest Cost query | 2025-03-26T09:30:00Z | production | john.doe | 1500 | 800 | 2300 | security-logs
humio | logs c.h.j.RunningQueriesLoggerJob | Highest Cost query | 2025-03-26T09:31:00Z | development | jane.smith | 2000 | 1200 | 3200 | app-logs |
humio | logs | c.h.j.RunningQueriesLoggerJob | Highest Cost query | 2025-03-26T09:32:00Z | staging | bob.wilson | 1000 | 500 | 1500 | infra-logs
humio | logs | c.h.j.RunningQueriesLoggerJob | Highest Cost query | 2025-03-26T09:33:00Z | production | john.doe | 1800 | 900 | 2700 | security-logs
humio | logs | c.h.j.RunningQueriesLoggerJob | Highest Cost query | 2025-03-26T09:34:00Z | development | jane.smith | 2500 | 1300 | 3800 | app-logs
humio | logs | c.h.j.RunningQueriesLoggerJob | Highest Cost query | 2025-03-26T09:35:00Z | staging | alice.cooper | 1200 | 600 | 1800 | infra-logs

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       #type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob message="Highest Cost query"

   Filters for Humio internal logs containing `c.h.j. RunningQueriesLoggerJob` in the class field and where the value in the message field is equal to `Highest Cost query`.

3. logscale

       | repoUser:= format("%s/%s", field=[dataspace, initiatingUser])

   Combines the fields dataspace and initiatingUser with a `/` separator, and then assigns the combined value to a new field named repoUser. Example of combined value: `dataspace/username`.

4. logscale

       | top(repoUser, sum=deltaTotalCost, as=cost)

   Finds the most common values in the field repoUser, makes a sum of the field deltaTotalCost, and returns the results in a new field named cost.

5. logscale

       |table([cost, repoUser], sortby=cost)

   Displays the results in a table with fields `cost` and `repoUser`, sorted by the column `cost`.

6. Event Result set.

##### Summary and Results

The query is used to search across multiple repositories and calculate query costs per user, by combining costs and showing the repository/user as a single field.

Sample output from the incoming example data:

cost | repoUser
--- | ---
3200 | development/jane.smith
2300 | production/john.doe
1500 | staging/bob.wilson

#### Display User Account Deletion Events in Table Format

Create a table showing deleted user accounts using the `table()` function

##### Query

logscale

    #event_simpleName=UserAccountDeleted
    aid=?aid
    table([aid, UserName, UserId], limit=1000)

##### Introduction

In this example, the `table()` function is used to create a structured view of deleted user accounts, displaying the account ID, username, and user ID.

Example incoming data might look like this:

@timestamp | event_simpleName | aid | UserName | UserId
--- | --- | --- | --- | ---
2025-10-06 08:00:00 | UserAccountDeleted | abc123 | john.doe | UID001
2025-10-06 08:15:30 | UserAccountDeleted | def456 | jane.smith | UID002
2025-10-06 09:20:45 | UserAccountDeleted | ghi789 | bob.wilson | UID003
2025-10-06 10:05:15 | UserAccountDeleted | jkl012 | sarah.jones | UID004
2025-10-06 11:30:00 | UserAccountDeleted | mno345 | mike.brown | UID005

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       #event_simpleName=UserAccountDeleted

   Filters events where event_simpleName equals `UserAccountDeleted`

3. logscale

       aid=?aid

   Filters results based on a specific account ID using the parameter aid.

   `aid=` is the parameter name and `?aid` is a placeholder for the actual aid value. The question mark (`?`) indicates a parameter placeholder that will be replaced with an actual value during execution.

4. logscale

       table([aid, UserName, UserId], limit=1000)

   Creates a table displaying the fields aid, UserName, and UserId. The `table()` function includes a `limit` parameter set to `1000` rows to prevent excessive output.

5. Event Result set.

##### Summary and Results

The query is used to create a structured table view of user account deletion events, showing essential account information.

This query is useful, for example, to monitor user account deletions, audit user management activities, or investigate security incidents related to account removals.

Sample output from the incoming example data:

aid | UserName | UserId
--- | --- | ---
abc123 | john.doe | UID001
def456 | jane.smith | UID002
ghi789 | bob.wilson | UID003
jkl012 | sarah.jones | UID004
mno345 | mike.brown | UID005

#### Enter search term