Appendix D. Appendix D - Reserved Words

The following words are reserved within LogScale; to use a reserved word as a string within a query, the word must be quoted, for example:

logscale
"groupBy"
accumulate appendAggregation array:append array:contains
array:dedup array:drop array:eval array:exists
array:filter array:intersection array:length array:reduceAll
array:reduceColumn array:reduceRow array:regex array:rename
array:sort array:union asn avg
base64Decode base64Encode beta:param beta:repeating
bitfield:extractFlags bitfield:extractFlagsAsArray bitfield:extractFlagsAsString bucket
callFunction case cidr coalesce
collect communityId concat concatArray
copyEvent correlate count counterAsRate
createEvents crypto:md5 crypto:sha1 crypto:sha256
default defineTable drop dropEvent
duration end eval eventFieldCount
eventInternals eventSize explain:asTable fieldset
fieldstats findTimestamp format formatDuration
formatTime geography:distance geohash getField
groupBy hash hashMatch hashRewrite
head if in ioc:lookup
ipLocation join json:prettyPrint kvParse
length like linReg lower
lowercase match matchAsArray math:abs
math:arccos math:arcsin math:arctan math:arctan2
math:ceil math:cos math:cosh math:deg2rad
math:exp math:expm1 math:floor math:log
math:log10 math:log1p math:log2 math:mod
math:pow math:rad2deg math:sin math:sinh
math:spherical2cartesian math:sqrt math:tan math:tanh
max min neighbor now
objectArray:eval objectArray:exists parseCEF parseCsv
parseFixedWidth parseHexString parseInt parseJson
parseLEEF parseTimestamp parseUri parseUrl
parseXml partition percentage percentile
range rdns readFile readPersistedAggregation
regex remoteTable rename replace
reverseDns round sample sankey
select selectFromMax selectFromMin selectLast
selfJoin selfJoinFilter series session
setField setTimeInterval shannonEntropy slidingTimeWindow
slidingWindow sort split splitString
start stats stdDev stripAnsiCodes
subnet sum table tail
test text:contains text:editDistance text:editDistanceAsArray
text:endsWith text:length text:positionOf text:startsWith
text:substring text:trim time:dayOfMonth time:dayOfWeek
time:dayOfWeekName time:dayOfYear time:hour time:millisecond
time:minute time:month time:monthName time:second
time:weekOfYear time:year timeChart tokenHash
top transpose unit:convert upper
urlDecode urlEncode wildcard window
worldMap writeJson xml:prettyPrint