The table() function displays query results in a table, allowing to specify the list of fields to include in the table.

The table() function is an aggregate function and does as follows:

  • Sorts columns in the table based on specified field order.
  • Aggregates events based on the limit parameter. It will limit the number of events returned using the limit parameter.
  • Sorts results according to the sortby parameter.

For large data exports, consider using the select() function instead. The select() function provides similar tabular output but without row limits or sorting constraints.

ParameterTypeRequiredDefault ValueDescription
fields[a]array of stringsrequired   The names of the fields to select.
limitnumberoptional[b] 200 The argument given to this parameter determines the limit on the number of rows included in the result of the function. The maximum is controlled by the StateRowLimit dynamic configuration, which is StateRowLimit by default. If the argument is max (limit=max), then the value of StateRowLimit is used.
orderarray of stringsoptional[b] desc Order to sort in.
   Values
   ascAscending (A-Z, 0-9) order
   descDescending (Z-A, 9-0) order
reversebooleanoptional[b]   Whether to sort in descending order. Deprecated: prefer order instead.
sortbyarray of stringsoptional[b] @timestamp Names of fields to sort by.
typearray of stringsoptional[b] number Type of the fields to sort.
   Values
   anyAny fields. (deprecated in 1.125)
   hexHexadecimal fields
   numberNumerical fields
   stringString fields

[a] The parameter name fields can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

table() Syntax Examples

Create a table of HTTP GET methods displaying the fields statuscode and responsetime:

logscale
method=GET
| table([statuscode, responsetime])

Display the 50 slowest requests by name and responsetime:

logscale
table([name, responsetime], sortby=responsetime, limit=50, order=asc)

table()Examples

Click + next to an example below to get the full details.

Calculate Query Costs by User and Repository in a Single Field

Calculate query costs by user across multiple repositories, showing the repository/user as a single field

Query
logscale
#type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob message="Highest Cost query"
| repoUser:= format("%s/%s", field=[dataspace, initiatingUser])
| top(repoUser, sum=deltaTotalCost, as=cost)
|table([cost, repoUser], sortby=cost)
Introduction

In this example, the query filter events in the humio repository that are tagged with kind equal to logs and then returns the events where the class field has values containing c.h.j.RunningQueriesLoggerJob, searching for the specific value Highest Cost query. The query then combines the results in a new field repoUser. The query then uses top() and table() functions to aggregate and display the results.

Example incoming data might look like this:

#type#kindclassmessagetimestampdataspaceinitiatingUsertotalLiveCosttotalStaticCostdeltaTotalCostrepo
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:30:00Zproductionjohn.doe15008002300security-logs
humiologs c.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:31:00Zdevelopmentjane.smith200012003200app-logs 
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:32:00Zstagingbob.wilson10005001500infra-logs
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:33:00Zproductionjohn.doe18009002700security-logs
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:34:00Zdevelopmentjane.smith250013003800app-logs
humiologsc.h.j.RunningQueriesLoggerJobHighest Cost query2025-03-26T09:35:00Zstagingalice.cooper12006001800infra-logs
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    #type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob message="Highest Cost query"

    Filters for Humio internal logs containing c.h.j. RunningQueriesLoggerJob in the class field and where the value in the message field is equal to Highest Cost query.

  3. logscale
    | repoUser:= format("%s/%s", field=[dataspace, initiatingUser])

    Combines the fields dataspace and initiatingUser with a / separator, and then assigns the combined value to a new field named repoUser. Example of combined value: dataspace/username.

  4. logscale
    | top(repoUser, sum=deltaTotalCost, as=cost)

    Finds the most common values in the field repoUser, makes a sum of the field deltaTotalCost, and returns the results in a new field named cost.

  5. logscale
    |table([cost, repoUser], sortby=cost)

    Displays the results in a table with fields cost and repoUser, sorted by the column cost.

  6. Event Result set.

Summary and Results

The query is used to search across multiple repositories and calculate query costs per user, by combining costs and showing the repository/user as a single field.

Sample output from the incoming example data:

costrepoUser
3200development/jane.smith
2300production/john.doe
1500staging/bob.wilson

Convert Values Between Units

Convert file size and transfer time units using the unit:convert() function

Query
logscale
unit:convert(field=file_size, from="B", to="MB")
| unit:convert(field=transfer_time, from="ms", to="s")
| table([file_size, transfer_time])
Introduction

In this example, the unit:convert() function is used to convert file sizes and transfer times units. The unit:convert() function automatically handles the mathematical conversion between units, making it easier to work with different measurement scales in the event set.

Note that any unit is supported in LogScale.

Example incoming data might look like this:

timestampfile_namefile_sizetransfer_timestatus
2025-05-15 05:30:00doc1.pdf10485763500complete
2025-05-15 05:31:00img1.jpg20971524200complete
2025-05-15 05:32:00video1.mp4524288012000complete
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    unit:convert(field=file_size, from="B", to="MB")

    Converts file sizes from Bytes (B) to Megabytes (MB).

  3. logscale
    | unit:convert(field=transfer_time, from="ms", to="s")

    Converts transfer times from milliseconds (ms) to seconds (s)

  4. logscale
    | table([file_size, transfer_time])

    Displays the result of the fields file_size and transfer_time in a table.

  5. Event Result set.

Summary and Results

The query is used to convert file sizes and transfer times units. A table showing file sizes and transfer times is, for example, useful to spot unusually large file transfers, to identify slow transfers or bottlenecks (for debugging).

The unit:convert() function is useful to standardize the units for better comparison and make data more readable.

Note that any unit is supported in LogScale. For more examples, see unit:convert().

Sample output from the incoming example data:

file_namefile_sizetransfer_time
doc1.pdf1.03.5
img1.jpg2.04.2
video1.mp45.012.0