Appendix D. Appendix D - Reserved Words

The following words are reserved within LogScale; to use a reserved word as a string within a query, the word must be quoted, for example:

logscale
"groupBy"
accumulate array:append array:contains array:dedup
array:drop array:eval array:exists array:filter
array:intersection array:length array:reduceAll array:reduceColumn
array:reduceRow array:regex array:rename array:sort
array:union asn avg base64Decode
base64Encode beta:param beta:repeating bitfield:extractFlags
bitfield:extractFlagsAsArray bitfield:extractFlagsAsString bucket callFunction
case cidr coalesce collect
communityId concat concatArray copyEvent
correlate count counterAsRate createEvents
crypto:md5 crypto:sha1 crypto:sha256 default
defineTable drop dropEvent duration
end eval eventFieldCount eventInternals
eventSize fieldset fieldstats findTimestamp
format formatDuration formatTime geography:distance
geohash getField groupBy hash
hashMatch hashRewrite head if
in ioc:lookup ipLocation join
json:prettyPrint kvParse length like
linReg lower lowercase match
matchAsArray math:abs math:arccos math:arcsin
math:arctan math:arctan2 math:ceil math:cos
math:cosh math:deg2rad math:exp math:expm1
math:floor math:log math:log10 math:log1p
math:log2 math:mod math:pow math:rad2deg
math:sin math:sinh math:spherical2cartesian math:sqrt
math:tan math:tanh max min
neighbor now objectArray:eval objectArray:exists
parseCEF parseCsv parseFixedWidth parseHexString
parseInt parseJson parseLEEF parseTimestamp
parseUri parseUrl parseXml partition
percentage percentile range rdns
readFile regex rename replace
reverseDns round sample sankey
select selectFromMax selectFromMin selectLast
selfJoin selfJoinFilter series session
setField setTimeInterval shannonEntropy slidingTimeWindow
slidingWindow sort split splitString
start stats stdDev stripAnsiCodes
subnet sum table tail
test text:contains text:endsWith text:length
text:positionOf text:startsWith text:substring time:dayOfMonth
time:dayOfWeek time:dayOfWeekName time:dayOfYear time:hour
time:millisecond time:minute time:month time:monthName
time:second time:weekOfYear time:year timeChart
tokenHash top transpose unit:convert
upper urlDecode urlEncode wildcard
window worldMap writeJson xml:prettyPrint