Appendix D. Appendix D - Reserved Words

The following words are reserved within LogScale; to use a reserved word as a string within a query, the word must be quoted, for example:

logscale
"groupBy"
accumulate array:append array:contains array:dedup
array:drop array:eval array:exists array:filter
array:intersection array:length array:reduceAll array:reduceColumn
array:reduceRow array:regex array:rename array:sort
array:union asn avg base64Decode
base64Encode beta:param beta:repeating bitfield:extractFlags
bitfield:extractFlagsAsArray bitfield:extractFlagsAsString bucket callFunction
case cidr coalesce collect
communityId concat concatArray copyEvent
correlate count counterAsRate createEvents
crypto:md5 crypto:sha1 crypto:sha256 default
defineTable drop dropEvent duration
end eval eventFieldCount eventInternals
eventSize fieldset fieldstats findTimestamp
format formatDuration formatTime geography:distance
geohash getField groupBy hash
hashMatch hashRewrite head if
in ioc:lookup ipLocation join
json:prettyPrint kvParse length like
linReg lower lowercase match
math:abs math:arccos math:arcsin math:arctan
math:arctan2 math:ceil math:cos math:cosh
math:deg2rad math:exp math:expm1 math:floor
math:log math:log10 math:log1p math:log2
math:mod math:pow math:rad2deg math:sin
math:sinh math:spherical2cartesian math:sqrt math:tan
math:tanh max min neighbor
now objectArray:eval objectArray:exists parseCEF
parseCsv parseFixedWidth parseHexString parseInt
parseJson parseLEEF parseTimestamp parseUri
parseUrl parseXml partition percentage
percentile range rdns readFile
regex rename replace reverseDns
round sample sankey select
selectFromMax selectFromMin selectLast selfJoin
selfJoinFilter series session setField
setTimeInterval shannonEntropy slidingTimeWindow slidingWindow
sort split splitString start
stats stdDev stripAnsiCodes subnet
sum table tail test
text:contains text:endsWith text:startsWith time:dayOfMonth
time:dayOfWeek time:dayOfWeekName time:dayOfYear time:hour
time:millisecond time:minute time:month time:monthName
time:second time:weekOfYear time:year timeChart
tokenHash top transpose unit:convert
upper urlDecode urlEncode wildcard
window worldMap writeJson xml:prettyPrint