Function Name | Description |
Randomly returns a non-NULL value from the target column. | |
Calculates the arithmetic mean of KEY. | |
Returns the result of performing a bitwise AND (AND) operation on all values in the target column. | |
Returns the result of performing a bitwise OR (OR) operation on all values in the target column. | |
Whether all logs meet the specified conditions. Returns TRUE if yes, otherwise returns FALSE. | |
Checks whether any log meets the specified conditions. Returns TRUE if yes, otherwise returns FALSE. | |
Calculates the checksum value of the target column. The returned result is a binary string. | |
Counts the number of all rows. | |
COUNT(1) is equivalent to COUNT(*), both of which returns the total number of rows. | |
Counts the number of non-NULL rows in the KEY column. | |
Counts the number of rows that meet specified conditions. | |
Whether all logs meet the specified conditions. Returns TRUE if yes, otherwise returns FALSE. | |
Calculates the geometric mean of the specified KEY column. This column must not contain negative values. Otherwise, the result is NaN. | |
Queries the maximum value in the KEY column. | |
Returns the value of x for the maximum value of y. | |
Returns the values of x corresponding to the n largest values of y. The returned result is a JSON array. | |
Returns the minimum value from the KEY column. | |
Returns the value of x for the minimum value of y. | |
Returns the values of x corresponding to the n smallest values of y. The returned result is a JSON array. | |
Calculates the sum of values in the KEY column. | |
Returns a map containing the count of occurrences for each input value. | |
Returns a map created from the input key/value pairs. | |
Returns the union of all input maps. If a key exists in multiple input maps, the value for that key in the resulting map comes from an arbitrary input map. | |
Returns a multimap created from the input key/value pairs. Each key can be associated with multiple values. |
Function Name | Description |
Addition: adds the values on both sides of the operator. | |
Subtraction: subtracts the value on the right of the operator from that on the left. | |
Multiplication: multiplies the values on both sides of the operator. | |
Division: divides the value on the left of the operator by that on the right. | |
Modulus: divides the value on the left of the operator by that on the right to obtain the remainder. | |
Checks whether the values on both sides of the operator are equal. If yes, the condition is true. | |
Checks whether the values on both sides of the operator are equal. If no, the condition is true. | |
Checks whether the values on both sides of the operator are equal. If no, the condition is true. | |
Checks whether the value on the left of the operator is greater than that on the right. If yes, the condition is true. | |
Checks whether the value on the left of the operator is less than that on the right. If yes, the condition is true. | |
Checks whether the value on the left of the operator is greater than or equal to that on the right. If yes, the condition is true. | |
Checks whether the value on the left of the operator is less than or equal to that on the right. If yes, the condition is true. | |
Compares a value with a specified list of values. | |
Compares a value with values not in a specified list. It is the opposite of the IN operator. | |
Searches for values among the values that fall within a specified range, including the minimum and maximum values. | |
Compares a value with similar values using wildcard operators. % represents zero, one, or more characters. _ represents a single number or character. | |
Compares a value with NULL. If the value is NULL, the condition is true. | |
Compares a value with NULL. If the value is not NULL, the condition is true. | |
Compares whether the x and y values are equal. | |
Returns the minimum value among the provided arguments. | |
Returns the maximum value among the provided arguments. | |
Returns true when x meets all conditions. | |
Returns true when x meets any conditions. |
Function Name | Description |
Estimates the number of unique values in the KEY column. The standard error of the estimation result is 2.3%. | |
Sorts values in the KEY column in ascending order and returns values approximately in the value range of percentage. The KEY column should be a value-type field, and the value range of percentage is [0, 1]. |
Function Name | Description |
Compares the value of x in the current time period with that in the time period n seconds ago. | |
Compares the value of x in the current time period with its values in the time periods n1, n2, and n3 seconds ago. | |
Compares the change trend of x over time in the current time period with its change trend in the time period n seconds ago. The time parameter specifies the time column that represents the change trend of x over time. | |
Compares the change trend of x over time in the current time period with its change trend in the time periods n1, n2, and n3 seconds ago. The time parameter specifies the time column that represents the change trend of x over time. |
Function Name | Description |
Returns the character that matches the ASCII character code specified by the input parameter. | |
Converts ASCII field values into Biglnt values. | |
Concatenates multiple strings (KEY1, KEY2, KEY3, ..., KEYN) into a character string. It has the same effect as the connection operator ||. Note: When any string is null, the returned value is null. To skip null strings, use concat_ws. | |
Concatenates the strings (KEY1, KEY2, KEY3, ..., KEYN) with split_string as the delimiter. Null values in KEY1, ..., KEYN are skipped. | |
Concatenates the elements in the array into a character string with split_string as the delimiter. If split_string is null, the result is null, and null values in the array are skipped. The return type is varchar. Note: The array(varchar) parameter in this function is an array, not a character string. | |
Formats the output of the args parameter using the format specified by format. | |
Converts a binary character string into a UTF-8 string. Invalid UTF-8 characters are replaced with U+FFFD. | |
Converts a binary character string into a UTF-8 string. Invalid UTF-8 characters are replaced with replace. | |
Returns the Hamming distance between the KEY1 string and the KEY2 string. Note: The two strings should have the same length. | |
Calculates the length of the KEY string. | |
Returns the edit distance between the KEY1 string and the KEY2 string. | |
Converts the KEY string into a lowercase one. | |
Pads the KEY string to the left to size size using padstring. If size is less than the length of KEY, the string is truncated to size size. size must be non-negative, and padstring must be non-empty. | |
Removes blank characters on the left side of the KEY string. | |
Converts a string to follow the NFC standard format. | |
Converts a string to the specified normalization form. The form parameter must be a keyword (NFD, NFC, NFKD, NFKC) rather than a string. | |
Returns the position of a substring in the KEY string, starting from 1. If the position is not found, 0 is returned. | |
Removes all substrings from the KEY string. | |
Replaces all substrings in the KEY string with replace. | |
Reverses the KEY string. | |
Pads the right side of the KEY string to the specified size using padstring. If the size is less than the length of KEY, the string is truncated to that size. The size should be a non-negative number, and padstring cannot be empty. | |
Removes blank characters on the right side of the KEY string. | |
Splits the KEY string using the specified delimiter and returns an array. | |
Splits the KEY string using the specified delimiter and returns an array with a maximum length specified by limit. The last element in the array always contains all the remaining parts of KEY. The limit value should be a positive number. | |
Splits the KEY string using the specified delimiter and returns a string in the index position in the array. The index value starts from 1. If the index value is greater than the array length, null is returned. | |
Returns the position of a substring in the KEY string, starting from 1. If the position is not found, 0 is returned. | |
Returns the position of the instance in a string after the KEY string is split into substrings. If the instance value is a negative number, the operation begins from the end of the string. The position result starts from 1, and 0 is returned if the position is not found. | |
Returns all characters in a string starting from the start position. The position value starts from 1. If the start value is a negative number, the operation begins from the end. | |
Returns the substring with a maximum length from a string, starting from the position specified by start. The position value starts from 1. If the start value is a negative number, the operation begins from the end. | |
Converts a string into a UTF-8 string of the varbinary type. | |
Replaces characters specified by from in the KEY string with the corresponding characters specified by to. If from contains duplicate characters, only the first character is used. If characters specified by from do not exist in KEY, they are directly copied to KEY. If from is longer than to, the corresponding excess characters are deleted. | |
Removes leading and trailing blank characters from a string. | |
Converts the KEY string into an uppercase one. | |
Returns the English root of word. | |
Returns the root of word in the language specified by lang. |
Function Name | Description |
Returns the current date. For example, 2022-12-28. | |
Returns the current time. For example, 17:08:18. | |
Return a timestamp of the current time (not in the Unix format), e.g. 2022-12-28T17:09:05.655+08:00 Asia/Shanghai. | |
Return the current time zone, e.g. Asia/Shanghai. | |
Adds value units of time (unit) to a timestamp. If value is negative, it subtracts the specified units. The unit parameter supports millisecond, second, minute, hour, day, week, month, quarter, and year. | |
Returns the time difference between two timestamps. The unit parameter supports millisecond, second, minute, hour, day, week, month, quarter, and year. | |
Converts a date or time of the TIMESTAMP type into a string in the format specified by format. For the description of format, see the function description. | |
Converts a date or time string in the format specified by format into a string of the TIMESTAMP type. For the description of format, see the function description. | |
Truncates a timestamp to the specified unit. This function is commonly used in scenarios requiring time-based statistical analysis. The unit parameter supports millisecond, second, minute, hour, day, week, month, quarter, and year. | |
Extracts the specified time part (field) from a timestamp. The field parameter supports the following values: year, quarter, month, week, day, day_of_month, day_of_week, dow, day_of_year, doy, year_of_week, yow, hour, minute, and second. | |
Converts a date string following the ISO 8601 standard into a date expression of the DATE type. | |
Converts a date or time string in the ISO 8601 format into a date or time expression with the time zone and of the TIMESTAMP type. | |
Converts a Unix timestamp into a date or time expression of the TIMESTAMP type. | |
Converts a Unix timestamp into a date or time expression with the time zone and of the TIMESTAMP type. | |
Groups the time column time_column into multiple buckets based on the time interval interval and performs statistical analysis on logs by group. The time_column must be a UNIX timestamp in milliseconds of the LONG type or a date/time expression of the TIMESTAMP type. The interval parameter supports units of SECOND (second), MINUTE (minute), HOUR (hour), and DAY (day). | |
Converts seconds into a human-readable time interval string, such as 1 minute or 36 seconds. | |
Returns the last day of the month corresponding to a timestamp. | |
Returns the local time. | |
Returns the local date and time. | |
Returns the current timestamp (in non-Unix format), equivalent to the current_timestamp function, for example, 2022-12-28T17:09:05.655+08:00[Asia/Shanghai]. | |
Converts a string into a period expression. | |
Divides the time column time_column into multiple groups by an interval and counts the logs by group. Missing data within the query time range can be completed. Values in time_column should be millisecond-level UNIX timestamps of the LONG type or date/time expressions of the TIMESTAMP type. Supported interval units include s (second), m (minute), h (hour), and d (day). format indicates a time format, and '%Y-%m-%dT%H:%i:%s+08:00' is recommended. padding indicates the data completion method. For details, see the function description. | |
Returns the hour offset of the time zone corresponding to a timestamp. | |
Returns the minute offset of the time zone corresponding to a timestamp. | |
Converts a date or time expression of the DATE or TIMESTAMP type into a date or time string following the ISO 8601 standard. | |
Returns the interval value in milliseconds. | |
Converts a date or time expression of the TIMESTAMP type into a Unix timestamp. |
Function Name | Description |
Obtains the IP address version, returned as IPv4 or IPv6. | |
Obtains the prefix of the target IP address. The returned result is an IP address in subnet mask format. | |
Obtains the maximum IP address in an IP range. The returned result is an IP address. | |
Obtains the minimum IP address in an IP range. The returned result is an IP address. | |
Obtains an IP range. The returned result is an array of IP addresses. | |
Analyzes the city of the target IP address. | |
Analyzes the code of the city corresponding to the target IP address. The returned result is the administrative code of the city. Taiwan (China) and cities outside China are not supported. | |
Analyzes the longitude and latitude of the city corresponding to the target IP address. The returned result is the longitude and latitude of the city. Taiwan (China) and cities outside China are not supported. | |
Analyzes the country or region of the target IP address. | |
Analyzes the code of the country or region corresponding to the target IP address. | |
Analyzes the longitude and latitude of the country or region corresponding to the target IP address. | |
Determines whether the target IP address is a private or public IP address. Returns intranet for private IP address, internet for public IP address, and invalid for invalid IP address. | |
Analyzes the Internet service provider (ISP) corresponding to the target IP address. | |
Analyzes the province of the target IP address. | |
Analyzes the code of the province corresponding to the target IP address. | |
Analyzes the longitude and latitude of the province corresponding to the target IP address. | |
Determines whether the target IP range is a subnet of an IP range. | |
Determines whether the target IP address is within an IP range. | |
Determines whether the specified IP address is a malicious IP address based on security intelligence from the Tencent Security Threat Intelligence Center. | |
Suspicious and malicious IP address's threat Tag, representing the specific malicious behavior of the IP address, with the return result being an array. | |
IP address threat detection details. The result is returned in JSON format. |
Function Name | Description |
Decodes a URL. | |
Performs URL encoding on KEY. | |
Extracts the fragment from a URL. | |
Extracts the host from a URL. | |
Extracts the parameter value corresponding to query from a URL. | |
Extracts the path from a URL. | |
Extracts the port from a URL. | |
Extracts the protocol from a URL. | |
Extracts the query from a URL. |
Function Name | Description |
Determines whether a JSON array contains a specified value. | |
Obtains the element at a specified index in a JSON array. | |
Calculates the number of elements in a JSON array. If x is not a JSON array, null is returned. | |
Extracts a set of JSON values (arrays or objects) from a JSON object or JSON array using json_path. The json_path syntax that requires traversing array elements, such as $.store.book[*].author, is not supported. | |
Extracts a set of scalar values (strings, integers, or Boolean values) from a JSON object or JSON array using json_path. The json_path syntax that requires traversing array elements, such as $.store.book[*].author, is not supported. | |
Converts a JSON value into a string value. | |
Converts a string value into a JSON value and determines whether the value matches the JSON format. | |
Calculates the number of elements in a JSON object or JSON array. |
Function Name | Description |
Obtain the corresponding value for a given key from the map. | |
Return the cardinality (size) of the map. | |
Returns the value corresponding to the given key. If the key does not exist, returns NULL. | |
Returns an empty map or creates a map using the given array of key/value pairs. | |
Create a map from a given array of entries. | |
Create a multimap from a given array of entries, where each key can be associated with multiple values. | |
Returns the union of all given maps. | |
Filter the map to create a new map with entries where the function returns true. | |
Returns all keys in the map. | |
Returns all values in the map. | |
Merges two maps into one and applies a function to the value pairs with the same keys. | |
Applies a function to each entry and transforms the keys. | |
Applies a function to each entry and transforms the values. |
Function Name | Description |
Extracts and returns the first substring that matches a regular expression from the target KEY string. | |
Extracts substrings that match a regular expression from the target KEY string, and returns the first substring that matches the target capture group. n represents capture group n, and the n value is an integer starting from 1. | |
Extracts substrings that match a regular expression from the target KEY string, and returns a collection of all substrings. | |
Extracts substrings that match a regular expression from the target KEY string, and returns a collection of substrings that match the target capture group. n represents the nth capture group, and the n value is an integer starting from 1. | |
Determines whether the target KEY string matches a regular expression. | |
Replaces substrings that match a regular expression in the target KEY string, and returns the string after replacement. | |
Deletes substrings that match a regular expression from the target KEY string. | |
Splits the target string with a regular expression, and returns a collection of substrings after splitting. |
Function Name | Description |
Returns all values in KEY as an array. | |
Deletes duplicate elements in an array and retains only unique values. | |
Calculates the difference of two arrays. | |
Calculates the intersection of two arrays. | |
Concatenates the elements in an array into a string using the specified delimiter. If null elements exist in the array, they are ignored. | |
Concatenates the elements in an array into a string using the specified delimiter. If null elements exist in the array, they are replaced by null_replacement. | |
Obtains the maximum value in an array. | |
Obtains the minimum value in an array. | |
Obtains the subscript of a specified element, starting from 1. If the element does not exist, 0 is returned. | |
Deletes a specified element from an array. | |
Sorts the elements in an array in ascending order. | |
Calculates the union of two arrays. | |
Calculates the number of elements in an array. | |
Determines whether an array contains a specified element. If yes, true is returned. | |
Returns the yth element in an array. The y value starts from 1. | |
Filters elements from an array. This function is used together with a lambda expression and returns only the elements that match the lambda expression. | |
Converts a two-dimensional array into a one-dimensional array. | |
Calculates the sum of the elements in an array according to a lambda expression and returns the calculation result. | |
Returns an array with consecutive and increasing values from x to y. | |
Returns an array with consecutive and increasing values from x to y (with a step of step). | |
Shuffles the elements in an array. | |
Returns a subset of array x. start specifies the starting index, and length specifies the number of elements in the subset. | |
Applies a lambda expression to each element in an array. | |
Merges multiple arrays into a two-dimensional array. Elements with the same subscript in each original array form a new array. | |
Merges two arrays into a single array by applying a lambda expression. |
Function Name | Description |
Converts the data type of the field KEY. If the conversion of a value fails, terminate the entire query. To skip failed values, use try_cast. The type value can be bigint, varchar, double, boolean, timestamp, decimal, array, or map. | |
Converts the data type of the field KEY. If the conversion of a value fails, returns null for that value and skips it to continue processing. The type value can be bigint, varchar, double, boolean, timestamp, decimal, array, or map. | |
Returns the data type of x. |
Function Name | Description |
Classifies data entries by a condition. | |
Obtains the first non-NULL value in multiple expressions. | |
If the condition is evaluated as true, result1 is returned. Otherwise, null is returned. | |
If the condition is evaluated as true, result1 is returned. Otherwise, result2 is returned. | |
Compares the values of two expressions. If the first expression equals the second expression, null is returned. Otherwise, the value of the first expression is returned. | |
Captures exception information so that the system continues the query and analysis operation. |
Function Name | Description |
Calculates the absolute value of a number. | |
Calculates the arc cosine of a number. | |
Calculates the arc sine of a number. | |
Calculates the arc tangent of a number. | |
Calculates the arc tangent of the quotient of two numbers. | |
Calculates the cube root of a number. | |
Rounds a number up to the nearest integer. | |
Calculates the cosine of a number. | |
Calculates the hyperbolic cosine of a number. | |
Calculates the cosine similarity between vectors x and y. | |
Converts radians to degrees. | |
Calculates the natural logarithm value of a number. | |
Returns the exponential of the natural logarithm. | |
Rounds a number down to the nearest integer. | |
Converts a string into a number in the radix system based on BASE encoding. | |
Returns a numeric value that represents positive infinity. | |
Determines whether the target value KEY is not a number (NaN). | |
Calculates the natural logarithm value of a number. | |
Calculates the base-b logarithm of a number. | |
Calculates the base-10 logarithm of a number. | |
Calculates the base-2 logarithm of a number. | |
Calculates the remainder of x divided by y. | |
Returns a NaN value. | |
Returns a π value with 14 decimal places. | |
Raises a number to the power of b. | |
Converts degrees to radians. | |
Returns a random number. | |
Returns a random number within the range of [0,n). | |
Returns a rounded integer of double. | |
Retains the n decimal places of double. | |
Returns the sign of a number, represented by 1, 0, or -1. | |
Calculates the sine of a number. | |
Calculates the square root of a number. | |
Calculates the tangent of a number. | |
Calculates the hyperbolic tangent of a number. | |
Converts x into a string in the radix system based on BASE encoding. | |
Truncates the decimal part of a number. | |
Specifies the scope of buckets with an array (bins) and returns the bucket of the number. | |
Divides a set of numbers (bound1 to bound2) into n buckets of the same size and returns the bucket of the number. |
Function Name | Description |
Calculates the correlation between two columns. The calculation result is in the range of [0, 1]. | |
Calculates the population covariance of two columns. | |
Calculates the sample covariance of two columns. | |
Returns the linear regression intercept of the input values, where key1 is the dependent variable and key2 is the independent variable. | |
Returns the linear regression slope of the input values, where key1 is the dependent variable and key2 is the independent variable. | |
Calculates the sample standard deviation of the key column. This function is equivalent to the stddev_samp function. | |
Returns the population standard deviation of the key column. | |
Calculates the sample standard deviation of the key column. | |
Calculates the population variance of the key column. | |
Calculates the sample variance of the key column. | |
Calculates the sample variance of the key column. This function is equivalent to the var_samp function. |
Function Name | Description |
Converts a base64 string to a binary string. | |
Converts a URL-safe base64 string to a binary string. | |
Converts a big-endian binary string into a number. | |
Converts a hexadecimal string into a binary string. | |
Calculates the MD5 hash of a binary string. | |
Calculates the SHA1 hash of a binary string. | |
Calculates the SHA256 hash of a binary string. | |
Calculates the SHA512 hash value of a binary string. | |
Converts a binary string into a base64 string. | |
Converts a binary string into a Base64 string with a URL safe alphabet. | |
Converts a number into a big-endian binary string. | |
Converts a binary string into a hexadecimal string. | |
Calculates the XxHash64 hash of a binary string. |
Function Name | Description |
Counts the number of 1s in the binary representation of x. | |
Performs a bitwise AND operation on x and y in binary form. | |
Performs a bitwise NOT operation on all bits of x in binary form. | |
Performs a bitwise OR operation on x and y in binary form. | |
Performs a bitwise XOR operation on x and y in binary form. |
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback