Contribute in GitHub:
Edit online
Supported operators and functions
IBM Data Explorer supports the following operators and functions in KQL queries.
Frequently used operators
Supported operators
- !=
- !~
- !between operator
- !contains_cs
- !contains
- !endswith_cs
- !endswith
- !has_cs
- !has
- !hasprefix_cs
- !hasprefix
- !hassuffix_cs
- !hassuffix
- !in
- !startswith_cs
- !startswith
- ==
- as operator
- between operator
- contains_cs
- contains
- count
- distinct
- endswith_cs
- endswith
- extend
- getschema operator
- has_all
- has_any
- has_cs
- has
- hasprefix_cs
- hasprefix
- hassuffix_cs
- hassuffix
- in
- in/!in operators
- make-series
- mv-expand
- parse operator
- project-away operator
- project-rename operator
- project
- regex
- sort by
- startswith_cs
- startswith
- summarize
- take
- top-hitters
- top
- where
Supported functions
- abs()
- abs()
- acos()
- array_concat()
- array_iif()
- array_index_of()
- array_length()
- array_reverse()
- array_rotate_left()
- array_rotate_right()
- array_shift_left()
- array_shift_right()
- array_slice()
- array_sort_asc()
- array_sort_desc()
- array_split()
- array_sum()
- asin()
- atan()
- atan2()
- base64_decode_toarray()
- base64_decode_toguid()
- base64_decode_tostring()
- base64_decode_tostring()
- base64_encode_fromguid()
- base64_encode_tostring()
- base64_encode_tostring()
- binary_all_and()
- binary_all_or()
- binary_all_xor()
- binary_and()
- binary_not()
- binary_or()
- binary_shift_left()
- binary_shift_right()
- binary_xor()
- bitset_count_ones()
- case()
- ceiling()
- cos()
- cot()
- count()
- countif()
- countof()
- count_distinct()
- count_distinctif()
- datetime_add()
- datetime_diff()
- datetime_part()
- dayofmonth()
- dayofweek()
- dayofyear()
- dcount()
- dcount_hll()
- degrees()
- exp()
- exp10()
- exp2()
- extract()
- extract_json()
- floor()
- format_datetime()
- format_ipv4_mask()
- format_ipv4()
- gamma()
- gettype()
- has_any_index()
- has_any_ipv4_prefix()
- has_any_ipv4()
- has_any_ipv6_prefix()
- has_any_ipv6()
- has_ipv4_prefix()
- has_ipv4()
- has_ipv6_prefix()
- has_ipv6()
- hll_merge()
- hll()
- indexof_regex()
- indexof()
- ipv4_compare()
- ipv4_is_in_range()
- ipv4_is_match()
- ipv4_is_private()
- ipv4_netmask_suffix
- ipv6_compare()
- ipv6_is_match()
- isempty()
- isfinite()
- isinf()
- isnan()
- isnotempty()
- isnotnull()
- isnull()
- log()
- log10()
- log2()
- loggamma()
- make_string()
- max_of()
- min_of()
- new_guid()
- not()
- pack_array()
- parse_csv()
- parse_ipv4_mask()
- parse_ipv4()
- parse_ipv6_mask()
- parse_ipv6()
- parse_json()
- parse_url()
- parse_urlquery()
- parse_version()
- pi()
- pow()
- radians()
- rand()
- repeat()
- replace_regex()
- round()
- set_difference()
- set_has_element()
- set_intersect()
- set_union()
- sign()
- sin()
- split()
- sqrt()
- strcat_delim()
- strcat()
- strcmp()
- string_size()
- strlen()
- strrep()
- substring()
- tan()
- to_utf8()
- tobool()
- todatetime()
- todouble()/toreal()
- toscalar()
- tostring()
- totimespan()
- toupper()
- translate()
- trim_end()
- trim_start()
- trim()
- url_decode()
- url_encode()
- variance()
- varianceif()
- variancep()
- zip()
Additional files