Appendix D. Appendix D - Reserved Words

The following words are reserved within LogScale; to use a reserved word as a string within a query, the word must be quoted, for example:

logscale
"groupBy"
accumulate appendAggregation array:append array:contains
array:dedup array:drop array:eval array:exists
array:filter array:intersection array:length array:reduceAll
array:reduceColumn array:reduceRow array:regex array:rename
array:sort array:union asn avg
base64Decode base64Encode beta:param beta:repeating
bitfield:extractFlags bitfield:extractFlagsAsArray bitfield:extractFlagsAsString bucket
callFunction case cidr coalesce
collect communityId concat concatArray
copyEvent correlate count counterAsRate
createEvents crypto:md5 crypto:sha1 crypto:sha256
default defineTable drop dropEvent
duration end eval eventFieldCount
eventInternals eventSize explain:asTable fieldset
fieldstats findTimestamp format formatDuration
formatTime geography:distance geohash getField
groupBy hash hashMatch hashRewrite
head if in ioc:lookup
ipLocation join json:prettyPrint kvParse
length like linReg lower
lowercase match matchAsArray math:abs
math:arccos math:arcsin math:arctan math:arctan2
math:ceil math:cos math:cosh math:deg2rad
math:exp math:expm1 math:floor math:log
math:log10 math:log1p math:log2 math:mod
math:pow math:rad2deg math:sin math:sinh
math:spherical2cartesian math:sqrt math:tan math:tanh
max min neighbor now
objectArray:eval objectArray:exists parseCEF parseCsv
parseFixedWidth parseHexString parseInt parseJson
parseLEEF parseTimestamp parseUri parseUrl
parseXml partition percentage percentile
range rdns readFile regex
rename replace reverseDns round
sample sankey select selectFromMax
selectFromMin selectLast selfJoin selfJoinFilter
series session setField setTimeInterval
shannonEntropy slidingTimeWindow slidingWindow sort
split splitString start stats
stdDev stripAnsiCodes subnet sum
table tail test text:contains
text:editDistance text:editDistanceAsArray text:endsWith text:length
text:positionOf text:startsWith text:substring text:trim
time:dayOfMonth time:dayOfWeek time:dayOfWeekName time:dayOfYear
time:hour time:millisecond time:minute time:month
time:monthName time:second time:weekOfYear time:year
timeChart tokenHash top transpose
unit:convert upper urlDecode urlEncode
wildcard window worldMap writeJson
xml:prettyPrint