String Query Functions

Humio's query functions take a set of events, parameters, or configurations; and produce, reduce, or modify values within that set, or within the events themselves within the query pipeline.

FunctionDescription
concat()Concatenates the values of a list of fields into a value in a new field.
concatArray()Concatenates values of all fields with same name and an array suffix into a new field.
length()Returns the number of characters in a string field.
lowercase()Changes field name or content to lowercase for parsers.
match()Searches text using a CSV or JSON file and can enhance entries.
regex()Extracts new fields using a regular expression.
replace()Replaces each substring that matches given regular expression with given replacement.
split()Splits an event structure created by json array into distinct events.
splitString()Splits a string by specifying a regular expression by which to split.
stripAnsiCodes()Removes ANSI color codes and movement commands.
tokenHash()Calculates a structure hash which is equal for similarly structured input.
transpose()Transposes a query results set by creating an event for each attribute.

Table: String Query Functions