Computes a non-cryptographic hash of a list of fields. The hash is
returned as an integer in the range [0,4294967295]. Calling this function
with the same values and the same seed (or no seed) will result in the
same hash being computed. This hash is not cryptographic and should not be
used to securely obscure data (instead use
hashRewrite() and hashMatch()
for that). This function can, for example, be used to reduce the number of
groups in a groupBy(), at the cost of having
collisions.
| Parameter | Type | Required | Default Value | Description |
|---|---|---|---|---|
as | string | optional[a] | _hash | The output name of the field to set. |
field[b] | array of strings | required | The fields for which to compute hash values. | |
limit | number | optional[a] | An upper bound on the number returned by this function. The returned hash will be modulo this value and thus be constrained to the range [0,limit]. | |
| Minimum | 1 | |||
seed | string | optional[a] | An optional seed for the hash function. | |
[a] Optional parameters use their default value unless explicitly set. | ||||
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
fieldcan be omitted; the following forms of this function are equivalent:logscale Syntaxhash(["value"])and:
logscale Syntaxhash(field=["value"])These examples show basic structure only.
hash() Examples
Hash the field a and put the result into
_hash:
hash(a)
Hash the fields a, b, and
c and put the result modulo 10 into
_hash
hash([a,b,c], limit=10)
Hash the field a (by setting field explicitly) using a
seed of 10
hash(field=[a], seed=10)
Group events into 10 buckets such that all events with the same value of
a ends in the same bucket.
hash(a, limit=10)
| groupby(_hash)