Appendix D. Appendix D - Reserved Words

The following words are reserved within LogScale; to use a reserved word as a string within a query, the word must be quoted, for example:

logscale
"groupBy"
accumulate array:append array:contains array:dedup
array:drop array:eval array:exists array:filter
array:intersection array:length array:reduceAll array:reduceColumn
array:reduceRow array:regex array:rename array:sort
array:union asn avg base64Decode
base64Encode beta:param beta:repeating bitfield:extractFlags
bitfield:extractFlagsAsArray bitfield:extractFlagsAsString bucket callFunction
case cidr coalesce collect
communityId concat concatArray copyEvent
correlate count counterAsRate createEvents
crypto:md5 crypto:sha1 crypto:sha256 default
defineTable drop dropEvent duration
end eval eventFieldCount eventInternals
eventSize explain:asTable fieldset fieldstats
findTimestamp format formatDuration formatTime
geography:distance geohash getField groupBy
hash hashMatch hashRewrite head
if in ioc:lookup ipLocation
join json:prettyPrint kvParse length
like linReg lower lowercase
match matchAsArray math:abs math:arccos
math:arcsin math:arctan math:arctan2 math:ceil
math:cos math:cosh math:deg2rad math:exp
math:expm1 math:floor math:log math:log10
math:log1p math:log2 math:mod math:pow
math:rad2deg math:sin math:sinh math:spherical2cartesian
math:sqrt math:tan math:tanh max
min neighbor now objectArray:eval
objectArray:exists parseCEF parseCsv parseFixedWidth
parseHexString parseInt parseJson parseLEEF
parseTimestamp parseUri parseUrl parseXml
partition percentage percentile range
rdns readFile regex rename
replace reverseDns round sample
sankey select selectFromMax selectFromMin
selectLast selfJoin selfJoinFilter series
session setField setTimeInterval shannonEntropy
slidingTimeWindow slidingWindow sort split
splitString start stats stdDev
stripAnsiCodes subnet sum table
tail test text:contains text:editDistance
text:editDistanceAsArray text:endsWith text:length text:positionOf
text:startsWith text:substring text:trim time:dayOfMonth
time:dayOfWeek time:dayOfWeekName time:dayOfYear time:hour
time:millisecond time:minute time:month time:monthName
time:second time:weekOfYear time:year timeChart
tokenHash top transpose unit:convert
upper urlDecode urlEncode wildcard
window worldMap writeJson xml:prettyPrint