Appendix D. Appendix D - Reserved Words
The following words are reserved within LogScale; to use a reserved word as a string within a query, the word must be quoted, for example:
logscale
"groupBy"
accumulate
|
appendAggregation
|
array:append
|
array:contains
|
array:dedup
|
array:drop
|
array:eval
|
array:exists
|
array:filter
|
array:intersection
|
array:length
|
array:reduceAll
|
array:reduceColumn
|
array:reduceRow
|
array:regex
|
array:rename
|
array:sort
|
array:union
|
asn
|
avg
|
base64Decode
|
base64Encode
|
beta:param
|
beta:repeating
|
bitfield:extractFlags
|
bitfield:extractFlagsAsArray
|
bitfield:extractFlagsAsString
|
bucket
|
callFunction
|
case
|
cidr
|
coalesce
|
collect
|
communityId
|
concat
|
concatArray
|
copyEvent
|
correlate
|
count
|
counterAsRate
|
createEvents
|
crypto:md5
|
crypto:sha1
|
crypto:sha256
|
default
|
defineTable
|
drop
|
dropEvent
|
duration
|
end
|
eval
|
eventFieldCount
|
eventInternals
|
eventSize
|
explain:asTable
|
fieldset
|
fieldstats
|
findTimestamp
|
format
|
formatDuration
|
formatTime
|
geography:distance
|
geohash
|
getField
|
groupBy
|
hash
|
hashMatch
|
hashRewrite
|
head
|
if
|
in
|
ioc:lookup
|
ipLocation
|
join
|
json:prettyPrint
|
kvParse
|
length
|
like
|
linReg
|
lower
|
lowercase
|
match
|
matchAsArray
|
math:abs
|
math:arccos
|
math:arcsin
|
math:arctan
|
math:arctan2
|
math:ceil
|
math:cos
|
math:cosh
|
math:deg2rad
|
math:exp
|
math:expm1
|
math:floor
|
math:log
|
math:log10
|
math:log1p
|
math:log2
|
math:mod
|
math:pow
|
math:rad2deg
|
math:sin
|
math:sinh
|
math:spherical2cartesian
|
math:sqrt
|
math:tan
|
math:tanh
|
max
|
min
|
neighbor
|
now
|
objectArray:eval
|
objectArray:exists
|
parseCEF
|
parseCsv
|
parseFixedWidth
|
parseHexString
|
parseInt
|
parseJson
|
parseLEEF
|
parseTimestamp
|
parseUri
|
parseUrl
|
parseXml
|
partition
|
percentage
|
percentile
|
range
|
readFile
|
readPersistedAggregation
|
regex
|
remoteTable
|
rename
|
replace
|
reverseDns
|
round
|
sample
|
sankey
|
select
|
selectFromMax
|
selectFromMin
|
selectLast
|
selfJoin
|
selfJoinFilter
|
series
|
session
|
setField
|
setTimeInterval
|
shannonEntropy
|
slidingTimeWindow
|
slidingWindow
|
sort
|
split
|
splitString
|
start
|
stats
|
stdDev
|
stripAnsiCodes
|
subnet
|
sum
|
table
|
tail
|
test
|
text:contains
|
text:editDistance
|
text:editDistanceAsArray
|
text:endsWith
|
text:length
|
text:positionOf
|
text:startsWith
|
text:substring
|
text:trim
|
time:dayOfMonth
|
time:dayOfWeek
|
time:dayOfWeekName
|
time:dayOfYear
|
time:hour
|
time:millisecond
|
time:minute
|
time:month
|
time:monthName
|
time:second
|
time:weekOfYear
|
time:year
|
timeChart
|
tokenHash
|
top
|
transpose
|
unit:convert
|
upper
|
urlDecode
|
urlEncode
|
wildcard
|
window
|
worldMap
|
writeJson
|
xml:prettyPrint
|