hash() Query Function

Computes a non-cryptographic hash of a list of fields. The hash is returned as an integer in the range [0,4294967295]. Calling this function with the same values and the same seed (or no seed) will result in the same hash being computed. This hash is not cryptographic and should not be used to securely obscure data (instead use hashRewrite() and hashMatch() for that). This function can for example be used to reduce the number of groups in a groupBy(), at the cost of having collisions.

Parameters

Name

Type

Required

Default

Description

field

[string]

Yes

The fields for which to compute hash values.

as

string

No

_hash

The output name of the field to set.

limit

number

No

An upper bound on the number returned by this function. The returned hash will be modulo this value and thus be constrained to the range [0,limit].

seed

string

No

An optional seed for the hash function.

The implied parameter is field.

Examples

Hash the field a and put the result in _hash:

humio
hash(a)

Hash the fields a, b, and c and put the result modulo 10 into _hash

humio
hash([a,b,c], limit=10)

Hash the field a (by setting field explicitly) using a seed of 10

humio
hash(field=[a], seed=10)

Group events into 10 buckets such that all events with the same value of a ends in the same bucket.

humio
hash(a, limit=10) | groupby(_hash)