Analyze function reference

These are the functions an Analyze expression can call. Log Explorer suggests the same set from the expression box as you type.

An argument’s type says what you may pass, not what the engine derives. NUMBER covers every numeric type, because an attribute read with @ has no declared type and is read as a number on demand — see attribute values. An argument in square brackets may be omitted, and a trailing … means the argument may be repeated.

Analyze is not the SQL transform. A SQL transform runs inside a pipeline on Flink SQL and supports a different function library, listed in its own reference. A function on that page may not exist here, and the functions below are not all available there.

Aggregate

Function	Arguments	Description	Example
`ANY_VALUE`	`value: ANY`	Return an arbitrary value from each group.	`ANY_VALUE(@status)` Returns one arbitrary value from the group, keeping the attribute as it was stored.
`APPROX_COUNT_DISTINCT`	`value: ANY, …`	Estimate the number of distinct values.	`APPROX_COUNT_DISTINCT(message)` Estimates how many distinct values the group holds.
`APPROX_PERCENTILE`	`value: NUMBER, fraction: NUMBER`	Estimate a percentile for numeric values. Returns a DOUBLE.	`APPROX_PERCENTILE(severity, 0.5)` Estimates the median, and always returns a DOUBLE. `APPROX_PERCENTILE(@duration_ms, 0.95)` Estimates the 95th percentile of a variant attribute.
`AVG`	`value: NUMBER`	Calculate the average numeric value; attribute types are inferred from context.	`AVG(severity)` Averages a numeric column across the group. `AVG(@duration_ms)` Reads a variant attribute as a number, giving NULL for any row where it does not hold one.
`COUNT`	`[value: ANY], …`	Count rows or distinct values.	`COUNT(*)` Counts every row in the group. `COUNT(@duration_ms)` Counts only the rows where the attribute is present.
`COVAR_POP`	`y: NUMBER, x: NUMBER`	Calculate population covariance.	`COVAR_POP(severity, severity)` Measures how two numeric columns vary together across the population.
`COVAR_SAMP`	`y: NUMBER, x: NUMBER`	Calculate sample covariance.	`COVAR_SAMP(severity, severity)` Measures how two numeric columns vary together in the sample.
`EVERY`	`condition: BOOLEAN`	Test whether every value in a group is true.	`EVERY(severity > 0)` Reports whether the condition held for every row in the group.
`MAX`	`value: ANY`	Return the maximum value; attribute types are inferred from context.	`MAX(severity)` Returns the largest value in the group. `MAX(@duration_ms)` Compares the attribute numerically, not as JSON text.
`MIN`	`value: ANY`	Return the minimum value; attribute types are inferred from context.	`MIN(severity)` Returns the smallest value in the group. `MIN(@duration_ms)` Compares the attribute numerically, not as JSON text.
`STDDEV`	`value: NUMBER`	Calculate sample standard deviation.	`STDDEV(severity)` Measures the sample standard deviation.
`STDDEV_POP`	`value: NUMBER`	Calculate population standard deviation.	`STDDEV_POP(severity)` Measures the population standard deviation.
`STDDEV_SAMP`	`value: NUMBER`	Calculate sample standard deviation.	`STDDEV_SAMP(severity)` Measures the sample standard deviation.
`SUM`	`value: NUMBER`	Sum numeric values; attribute types are inferred from context.	`SUM(severity)` Totals a numeric column across the group. `SUM(@duration_ms)` Reads a variant attribute as a number, giving NULL for any row where it does not hold one.
`VARIANCE`	`value: NUMBER`	Calculate statistical variance.	`VARIANCE(severity)` Measures the sample variance.
`VAR_POP`	`value: NUMBER`	Calculate population variance.	`VAR_POP(severity)` Measures the population variance.
`VAR_SAMP`	`value: NUMBER`	Calculate sample variance.	`VAR_SAMP(severity)` Measures the sample variance.

Attributes and variants

Function	Arguments	Description	Example
`VARIANT_SOME_BETWEEN`	`attribute: ANY, lower: NUMBER, upper: NUMBER, lowerInclusive: BOOLEAN, upperInclusive: BOOLEAN`	Test whether a Variant value is in a numeric range.	`VARIANT_SOME_BETWEEN(@status, 400, 500, TRUE, TRUE)` Matches a numeric range, with each bound included or excluded explicitly.
`VARIANT_SOME_EQ`	`attribute: ANY, value: ANY`	Compare a Variant value for equality.	`VARIANT_SOME_EQ(@status, 404)` Matches when the attribute, or any element of it, equals the value.
`VARIANT_SOME_EQ_ALL`	`attribute: ANY, value: ANY, more: ANY, …`	Compare a Variant value against all candidates.	`VARIANT_SOME_EQ_ALL(@status, 404, 500)` Matches when the attribute covers every one of the candidates.
`VARIANT_SOME_EQ_IN`	`attribute: ANY, value: ANY, more: ANY, …`	Compare a Variant value against any candidate.	`VARIANT_SOME_EQ_IN(@status, 404, 500)` Matches when the attribute equals any one of the candidates.
`VARIANT_SOME_GE`	`attribute: ANY, value: ANY`	Compare a Variant value as greater than or equal.	`VARIANT_SOME_GE(@status, 400)` Matches when the attribute, or any element of it, is greater or equal.
`VARIANT_SOME_GT`	`attribute: ANY, value: ANY`	Compare a Variant value as greater than.	`VARIANT_SOME_GT(@status, 400)` Matches when the attribute, or any element of it, is greater.
`VARIANT_SOME_LE`	`attribute: ANY, value: ANY`	Compare a Variant value as less than or equal.	`VARIANT_SOME_LE(@status, 500)` Matches when the attribute, or any element of it, is smaller or equal.
`VARIANT_SOME_LT`	`attribute: ANY, value: ANY`	Compare a Variant value as less than.	`VARIANT_SOME_LT(@status, 500)` Matches when the attribute, or any element of it, is smaller.
`VARIANT_SOME_STRING_RANGE`	`attribute: ANY, lower: TEXT, upper: TEXT, lowerInclusive: BOOLEAN, upperInclusive: BOOLEAN`	Test whether a Variant value is in a text range.	`VARIANT_SOME_STRING_RANGE(@status, 'a', 'z', TRUE, TRUE)` Matches a text range, with each bound included or excluded explicitly.

String

Function	Arguments	Description	Example
`CHARACTER_LENGTH`	`text: TEXT`	Return the number of characters in text.	`CHARACTER_LENGTH(message)` Counts the characters in a string, spelled out in full.
`CHAR_LENGTH`	`text: TEXT`	Return the number of characters in text.	`CHAR_LENGTH(message)` Counts the characters in a string.
`CONCAT`	`value: ANY, more: ANY, …`	Concatenate values as text.	`CONCAT(message, 'x')` Joins two values into one string. `CONCAT(message, ':', severity)` Joins any number of values, converting each to text.
`LOWER`	`text: TEXT`	Convert text to lower case.	`LOWER(message)` Converts a string to lower case.
`POSITION`	`keyword syntax — see the example`	Find text within a string.	`POSITION('a' IN message)` Returns the 1-based position of a substring, or 0 when it is absent.
`REGEXP_CONTAINS`	`text: TEXT, pattern: TEXT`	Test whether text matches a regular expression.	`REGEXP_CONTAINS(message, 'a')` Reports whether a regular expression matches anywhere in the text.
`REGEXP_EXTRACT`	`text: TEXT, pattern: TEXT, [group: NUMBER]`	Extract text captured by a regular expression.	`REGEXP_EXTRACT(message, 'a')` Returns the text a regular expression matched, or NULL when it did not match. `REGEXP_EXTRACT(message, '(a)(b)', 2)` Returns a numbered capture group rather than the whole match.
`REPLACE`	`text: TEXT, search: TEXT, replacement: TEXT`	Replace matching text in a string.	`REPLACE(message, 'a', 'b')` Replaces every occurrence of one string with another.
`SEVERITY_TEXT`	`severity: NUMBER`	Convert an OTel severity number to its name.	`SEVERITY_TEXT(severity)` Names the severity bucket: TRACE, DEBUG, INFO, WARN, ERROR or FATAL.
`SUBSTRING`	`keyword syntax — see the example`	Extract part of a string.	`SUBSTRING(message FROM 1 FOR 3)` Takes a fixed number of characters from a starting position. `SUBSTRING(message FROM 5)` Takes everything from the starting position to the end.
`TRIM`	`text: TEXT`	Remove leading or trailing characters.	`TRIM(message)` Removes leading and trailing whitespace.
`UPPER`	`text: TEXT`	Convert text to upper case.	`UPPER(message)` Converts a string to upper case.

Date and time

Function	Arguments	Description	Example
`CONVERT_TIMEZONE`	`source: TEXT, target: TEXT, timestamp: TIMESTAMP`	Convert a UTC timestamp to another time zone. Source must be UTC.	`CONVERT_TIMEZONE('UTC', 'America/Chicago', event_timestamp)` Converts a stored timestamp into another time zone; the source must be 'UTC', which is how Grepr stores timestamps.
`CURRENT_DATE`	`no arguments`	Return the current date.	`CURRENT_DATE` Returns the current date, in UTC.
`CURRENT_TIMESTAMP`	`see the example`	Return the current timestamp.	`CURRENT_TIMESTAMP` Returns the current timestamp, in UTC.
`DATE_FORMAT`	`format: TEXT, timestamp: TIMESTAMP, [timezone: TEXT]`	Format a date or timestamp as text.	`DATE_FORMAT('yyyy-MM-dd', event_timestamp)` Renders a timestamp as text in a given pattern. `DATE_FORMAT('yyyy-MM-dd', event_timestamp, 'America/Chicago')` Renders the timestamp in a given time zone rather than UTC.
`DAYOFMONTH`	`timestamp: TIMESTAMP`	Extract the day of month from a timestamp.	`DAYOFMONTH(event_timestamp)` Returns the day of the month.
`DAYOFWEEK`	`timestamp: TIMESTAMP`	Extract the day of week from a timestamp.	`DAYOFWEEK(event_timestamp)` Returns the day of the week.
`DAYOFYEAR`	`timestamp: TIMESTAMP`	Extract the day of year from a timestamp.	`DAYOFYEAR(event_timestamp)` Returns the day of the year.
`EXTRACT`	`keyword syntax — see the example`	Extract a date or time field.	`EXTRACT(HOUR FROM event_timestamp)` Pulls one calendar field out of a timestamp.
`HOUR`	`timestamp: TIMESTAMP`	Extract the hour from a timestamp.	`HOUR(event_timestamp)` Returns the hour, 0 to 23.
`LAST_DAY`	`timestamp: TIMESTAMP`	Return the last day of a calendar period.	`LAST_DAY(event_timestamp)` Returns the last day of that month.
`MINUTE`	`timestamp: TIMESTAMP`	Extract the minute from a timestamp.	`MINUTE(event_timestamp)` Returns the minute, 0 to 59.
`MONTH`	`timestamp: TIMESTAMP`	Extract the month from a timestamp.	`MONTH(event_timestamp)` Returns the calendar month, 1 to 12.
`QUARTER`	`timestamp: TIMESTAMP`	Extract the quarter from a timestamp.	`QUARTER(event_timestamp)` Returns the calendar quarter, 1 to 4.
`SECOND`	`timestamp: TIMESTAMP`	Extract the second from a timestamp.	`SECOND(event_timestamp)` Returns the second, 0 to 59.
`TIMESTAMPADD`	`unit: TIME_UNIT, count: NUMBER, timestamp: TIMESTAMP`	Add a time interval to a timestamp.	`TIMESTAMPADD(HOUR, 1, event_timestamp)` Shifts a timestamp forward by a whole number of calendar units.
`TIMESTAMPDIFF`	`unit: TIME_UNIT, start: TIMESTAMP, end: TIMESTAMP`	Measure the interval between timestamps.	`TIMESTAMPDIFF(HOUR, event_timestamp, event_timestamp)` Counts whole calendar units between two timestamps.
`WEEK`	`timestamp: TIMESTAMP`	Extract the week from a timestamp.	`WEEK(event_timestamp)` Returns the week of the year.
`YEAR`	`timestamp: TIMESTAMP`	Extract the year from a timestamp.	`YEAR(event_timestamp)` Returns the calendar year.

Numeric

Function	Arguments	Description	Example
`ABS`	`value: NUMBER`	Return the absolute numeric value.	`ABS(severity)` Returns the magnitude of a number, without its sign. `ABS(@duration_ms)` Reads a variant attribute as a number, giving NULL for any row where it does not hold one.
`ACOS`	`value: NUMBER`	Return the inverse cosine.	`ACOS(severity)` Returns the arc cosine, in radians.
`ASIN`	`value: NUMBER`	Return the inverse sine.	`ASIN(severity)` Returns the arc sine, in radians.
`ATAN`	`value: NUMBER`	Return the inverse tangent.	`ATAN(severity)` Returns the arc tangent, in radians.
`ATAN2`	`y: NUMBER, x: NUMBER`	Return the two-argument inverse tangent.	`ATAN2(severity, severity)` Returns the angle to a point, using both coordinates to fix the quadrant.
`CEIL`	`value: NUMBER`	Round a numeric value up.	`CEIL(severity)` Rounds up to a whole number.
`COS`	`value: NUMBER`	Return the cosine.	`COS(severity)` Returns the cosine of an angle in radians.
`COT`	`value: NUMBER`	Return the cotangent.	`COT(severity)` Returns the cotangent of an angle in radians.
`DEGREES`	`radians: NUMBER`	Convert radians to degrees.	`DEGREES(severity)` Converts radians to degrees.
`EXP`	`value: NUMBER`	Return e raised to a power.	`EXP(severity)` Raises e to the given power.
`FLOOR`	`value: NUMBER`	Round a numeric value down.	`FLOOR(severity)` Rounds down to a whole number. `FLOOR(event_timestamp TO HOUR)` Truncates a timestamp down to the start of a calendar unit.
`LN`	`value: NUMBER`	Return the natural logarithm.	`LN(severity)` Returns the natural logarithm.
`LOG`	`value: NUMBER, [base: NUMBER]`	Return a logarithm with the selected base.	`LOG(severity)` Returns the natural logarithm when no base is given. `LOG(severity, 2)` Returns the logarithm in a given base.
`LOG10`	`value: NUMBER`	Return the base-10 logarithm.	`LOG10(severity)` Returns the base-10 logarithm.
`MOD`	`dividend: NUMBER, divisor: NUMBER`	Return the remainder after division.	`MOD(severity, 2)` Returns the remainder of a division.
`PI`	`no arguments`	Return the mathematical constant pi.	`PI()` Returns the constant pi.
`POWER`	`base: NUMBER, exponent: NUMBER`	Raise a number to a power.	`POWER(severity, 2)` Raises a number to a power.
`RADIANS`	`degrees: NUMBER`	Convert degrees to radians.	`RADIANS(severity)` Converts degrees to radians.
`ROUND`	`value: NUMBER, [digits: NUMBER]`	Round a numeric value.	`ROUND(severity)` Rounds to the nearest whole number. `ROUND(severity, 2)` Rounds to a given number of decimal places.
`SIGN`	`value: NUMBER`	Return the sign of a numeric value.	`SIGN(severity)` Returns -1, 0, or 1 according to the sign.
`SIN`	`value: NUMBER`	Return the sine.	`SIN(severity)` Returns the sine of an angle in radians.
`SQRT`	`value: NUMBER`	Return the square root of a number.	`SQRT(severity)` Returns the square root.
`TAN`	`value: NUMBER`	Return the tangent.	`TAN(severity)` Returns the tangent of an angle in radians.
`TRUNCATE`	`value: NUMBER, [digits: NUMBER]`	Truncate a numeric value.	`TRUNCATE(severity)` Drops the fractional part, without rounding. `TRUNCATE(severity, 2)` Keeps a given number of decimal places, without rounding.

Conditional

Function	Arguments	Description	Example
`CASE`	`keyword syntax — see the example`	Return a value based on ordered conditions.	`CASE WHEN severity > 3 THEN 'high' ELSE 'low' END` Picks a result from the first condition that holds. `CASE WHEN severity > 4 THEN 'error' WHEN severity > 2 THEN 'warn' ELSE 'info' END` Tests conditions in order, so the first match wins.
`COALESCE`	`value: ANY, fallback: ANY, …`	Return the first non-null expression.	`COALESCE(message, 'none')` Returns the first argument that is not NULL. `COALESCE(@duration_ms, severity, 0)` Falls through several candidates to a literal default.
`NULLIF`	`value: ANY, other: ANY`	Return NULL when two expressions are equal.	`NULLIF(message, 'none')` Returns NULL when the two arguments are equal, and the first otherwise.

Type conversion

Function	Arguments	Description	Example
`CAST`	`keyword syntax — see the example`	Convert an expression to a specific SQL type when type or precision control is needed.	`CAST(severity AS VARCHAR)` Converts a value to a named SQL type. `CAST(@duration_ms AS BIGINT)` Forces an attribute to an exact type instead of the inferred one.
`IS_NUMERIC`	`value: ANY`	Test whether an attribute is stored as a numeric type.	`IS_NUMERIC(@status)` Reports whether an attribute was stored as a number.
`TO_JSON_STRING`	`value: ANY`	Serialize a value as JSON text.	`TO_JSON_STRING(@status)` Renders a value as JSON text.
`TRY_CAST`	`keyword syntax — see the example`	Convert an expression, returning NULL when conversion fails.	`TRY_CAST(message AS BIGINT)` Converts a value, giving NULL instead of failing when it will not convert.
`TYPEOF`	`value: ANY`	Return the SQL type of an expression.	`TYPEOF(@status)` Reports the SQL type an expression resolved to.

Arrays and maps

Function	Arguments	Description	Example
`ARRAY_CONTAINS`	`array: ARRAY, value: ANY`	Test whether an array contains a value.	`ARRAY_CONTAINS(tags['service'], 'api')` Reports whether an indexed tag holds a given value.
`ARRAY_CONTAINS_ALL_IGNORE_CASE`	`array: ARRAY, value: TEXT, more: TEXT, …`	Test whether all values occur in an array.	`ARRAY_CONTAINS_ALL_IGNORE_CASE(tags['service'], 'api', 'web')` Reports whether every one of the given values occurs.
`ARRAY_CONTAINS_ANY_IGNORE_CASE`	`array: ARRAY, value: TEXT, more: TEXT, …`	Test whether any value occurs in an array.	`ARRAY_CONTAINS_ANY_IGNORE_CASE(tags['service'], 'api', 'web')` Reports whether at least one of the given values occurs.
`ARRAY_CONTAINS_IGNORE_CASE`	`array: ARRAY, value: TEXT`	Test array membership without case sensitivity.	`ARRAY_CONTAINS_IGNORE_CASE(tags['service'], 'api')` Reports tag membership without regard to case.
`ARRAY_TO_STRING`	`array: ARRAY, delimiter: TEXT, [nullValue: TEXT]`	Join array elements into a string.	`ARRAY_TO_STRING(tags['service'], ',')` Joins the values of an indexed tag into one string. `ARRAY_TO_STRING(tags['service'], ',', 'none')` Substitutes a placeholder for null elements instead of skipping them.
`CARDINALITY`	`collection: ANY`	Return the number of elements in a collection.	`CARDINALITY(tags)` Counts the entries in a map or array.
`MAP_KEYS`	`map: MAP`	Return the keys of a map.	`MAP_KEYS(tags)` Returns the keys a map holds.
`MAP_VALUES`	`map: MAP`	Return the values of a map.	`MAP_VALUES(tags)` Returns the values a map holds.
`SORT_ARRAY`	`array: ARRAY, [ascending: BOOLEAN]`	Sort the elements of an array ascending; pass FALSE as the second argument for descending. The elements must be numbers, strings, binary or date-time values. Sorting a tag's values first makes the same combination of values group together.	`SORT_ARRAY(tags['team'])` Sorts the team tag's values. `ARRAY_TO_STRING(SORT_ARRAY(tags['team']), ',')` Groups rows by the whole set of team values, in a stable order.

Bitwise

Function	Arguments	Description	Example
`BITAND`	`left: NUMBER, right: NUMBER`	Apply a bitwise AND operation.	`BITAND(severity, 1)` Combines two integers with a bitwise AND.
`BITCOUNT`	`value: NUMBER`	Count set bits in an integer.	`BITCOUNT(severity)` Counts the bits set in an integer.
`BITNOT`	`value: NUMBER`	Apply a bitwise NOT operation.	`BITNOT(severity)` Inverts every bit of an integer.
`BITOR`	`left: NUMBER, right: NUMBER`	Apply a bitwise OR operation.	`BITOR(severity, 1)` Combines two integers with a bitwise OR.
`BITXOR`	`left: NUMBER, right: NUMBER`	Apply a bitwise XOR operation.	`BITXOR(severity, 1)` Combines two integers with a bitwise exclusive OR.

Frequently Asked Questions

What SQL functions can I use in a Grepr analysis?

Aggregates such as COUNT, SUM, MIN, MAX, AVG, APPROX_PERCENTILE and APPROX_COUNT_DISTINCT, plus string, date and time, numeric, conditional, type-conversion, array and map, variant and bitwise functions. Log Explorer's expression box suggests the same set as you type.

Are the SQL transform functions the same as the Analyze functions?

No. A SQL transform runs inside a pipeline on Flink SQL; an analysis runs on the query engine over the data lake. The two support different function libraries, so a function documented for the SQL transform may not exist in an analysis.

How do I compute a percentile in Grepr?

Use APPROX_PERCENTILE(value, fraction), as in APPROX_PERCENTILE(@duration_ms, 0.95) for a 95th percentile. It takes a numeric value and a fraction between 0 and 1, and always returns a DOUBLE.