Formatting Query Functions

Humio’s query functions take a set of events, parameters, or configurations; and produce, reduce, or modify values within that set, or within the events themselves within the query pipeline.

Below is an alphabetical listing of Humio query functions related to formatting data from fields. For more information on a particular query function, click on it.

Function

Description

concat()

Concatenates the values of a list of fields into a value in a new field.

concatArray()

Concatenates values of all fields with same name and an array suffix into a new field.

format()

Formats a string using printf-style.

formatDuration()

Formats a duration into a more readable string.

formatTime()

Formats a string according to strftime, similar to unix strftime.

json:prettyPrint()

Nicer output to a JSON field.

lookup()

Enhances events with metadata.

lower()

Changes text of a given string field to lowercase letters.

lowercase()

Changes field name or content to lowercase for parsers—use lower() in queries.

rename()

Renames a given field.

replace()

Replaces each substring that matches given regular expression with given replacement.

upper()

Changes contents of a string field to upper-case letters.

xml:prettyPrint()

Nicer output to an XML field.