Appendix D. Appendix D - Reserved Words

The following words are reserved within LogScale; to use a reserved word as a string within a query, the word must be quoted, for example:

logscale
"groupBy"
array:append array:contains array:drop array:eval
array:filter array:intersection array:length array:reduceAll
array:reduceColumn array:reduceRow array:regex array:rename
array:union asn avg base64Decode
beta:param beta:repeating bitfield:extractFlags bitfield:extractFlagsAsArray
bitfield:extractFlagsAsString bucket callFunction case
cidr coalesce collect communityId
concat concatArray copyEvent count
counterAsRate createEvents crypto:md5 crypto:sha1
crypto:sha256 default defineTable drop
dropEvent duration end eval
eventFieldCount eventInternals eventSize fieldset
fieldstats findTimestamp format formatDuration
formatTime geography:distance geohash getField
groupBy hash hashMatch hashRewrite
head if in ioc:lookup
ipLocation join json:prettyPrint kvParse
length linReg lower lowercase
match math:abs math:arccos math:arcsin
math:arctan math:arctan2 math:ceil math:cos
math:cosh math:deg2rad math:exp math:expm1
math:floor math:log math:log10 math:log1p
math:log2 math:mod math:pow math:rad2deg
math:sin math:sinh math:spherical2cartesian math:sqrt
math:tan math:tanh max min
now objectArray:eval parseCEF parseCsv
parseFixedWidth parseHexString parseInt parseJson
parseLEEF parseTimestamp parseUri parseUrl
parseXml percentile range rdns
readFile regex rename replace
round rpc sample sankey
select selectFromMax selectFromMin selectLast
selfJoin selfJoinFilter series session
setField shannonEntropy sort split
splitString start stats stdDev
stripAnsiCodes subnet sum table
tail test text:contains time:dayOfMonth
time:dayOfWeek time:dayOfWeekName time:dayOfYear time:hour
time:millisecond time:minute time:month time:monthName
time:second time:weekOfYear time:year timeChart
tokenHash top transpose unit:convert
upper urlDecode urlEncode wildcard
window worldMap writeJson xml:prettyPrint