The table() function displays query results in a table, allowing to specify the list of fields to include in the table.

The table() function is an aggregate function and does as follows:

  • Sorts columns in the table based on specified field order.
  • Aggregates events based on the limit parameter. It will limit the number of events returned using the limit parameter.
  • Sorts results according to the sortby parameter.

For large data exports, consider using the select() function instead. The select() function provides similar tabular output but without row limits or sorting constraints.

ParameterTypeRequiredDefault ValueDescription
fields[a]array of stringsrequired   The names of the fields to select.
limitnumberoptional[b] 200 The argument given to this parameter determines the limit on the number of rows included in the result of the function. The maximum is controlled by the StateRowLimit dynamic configuration, which is StateRowLimit by default. If the argument is max (limit=max), then the value of StateRowLimit is used.
orderarray of stringsoptional[b] desc Order to sort in.
   Values
   ascAscending (A-Z, 0-9) order
   descDescending (Z-A, 9-0) order
reversebooleanoptional[b]   Whether to sort in descending order. Deprecated: prefer order instead.
sortbyarray of stringsoptional[b] @timestamp Names of fields to sort by.
typearray of stringsoptional[b] number Type of the fields to sort.
   Values
   anyAny fields. (deprecated in 1.125)
   hexHexadecimal fields
   numberNumerical fields
   stringString fields

[a] The parameter name fields can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

table() Syntax Examples

Create a table of HTTP GET methods displaying the fields statuscode and responsetime:

logscale
method=GET
| table([statuscode, responsetime])

Display the 50 slowest requests by name and responsetime:

logscale
table([name, responsetime], sortby=responsetime, limit=50, order=asc)

table()Examples

Click + next to an example below to get the full details.

Calculate Query Costs by User and Repository in a Single Field

Calculate query costs by user across multiple repositories, showing the repository/user as a single field

Query
logscale
#type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob message="Highest Cost query"
| repoUser:= format("%s/%s", field=[dataspace, initiatingUser])
| top(repoUser, sum=deltaTotalCost, as=cost)
|table([cost, repoUser], sortby=cost)
Introduction

In this example, the query filter events in the humio repository that are tagged with kind equal to logs and then returns the events where the class field has values containing c.h.j.RunningQueriesLoggerJob, searching for the specific value Highest Cost query. The query then combines the results in a new field repoUser. The query then uses top() and table() functions to aggregate and display the results.

Example incoming data might look like this:

#type#kindclassmessagetimestampdataspaceinitiatingUsertotalLiveCosttotalStaticCostdeltaTotalCostrepo
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:30:00Zproductionjohn.doe15008002300security-logs
humiologs c.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:31:00Zdevelopmentjane.smith200012003200app-logs 
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:32:00Zstagingbob.wilson10005001500infra-logs
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:33:00Zproductionjohn.doe18009002700security-logs
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:34:00Zdevelopmentjane.smith250013003800app-logs
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:35:00Zstagingalice.cooper12006001800infra-logs
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    #type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob message="Highest Cost query"

    Filters for Humio internal logs containing c.h.j. RunningQueriesLoggerJob in the class field and where the value in the message field is equal to Highest Cost query.

  3. logscale
    | repoUser:= format("%s/%s", field=[dataspace, initiatingUser])

    Combines the fields dataspace and initiatingUser with a / separator, and then assigns the combined value to a new field named repoUser. Example of combined value: dataspace/username.

  4. logscale
    | top(repoUser, sum=deltaTotalCost, as=cost)

    Finds the most common values in the field repoUser, makes a sum of the field deltaTotalCost, and returns the results in a new field named cost.

  5. logscale
    |table([cost, repoUser], sortby=cost)

    Displays the results in a table with fields cost and repoUser, sorted by the column cost.

  6. Event Result set.

Summary and Results

The query is used to search across multiple repositories and calculate query costs per user, by combining costs and showing the repository/user as a single field.

Sample output from the incoming example data:

costrepoUser
3200development/jane.smith
2300production/john.doe
1500staging/bob.wilson