| Name | Description | Example |
|---|---|---|
| <from> | Get data from table | table1 |
datatable | Use provided test data | datatable [{"foo":"bar"}] |
extend | Add a new field | T | extend foo=bar |
join | Join with another table | T | join kind=inner dest=(foo) on $left.id == $right.id |
limit | Limit the number of rows | T | limit 10 |
project | Show only certain fields | T | project foo, bar |
range | Generate a sequence of rows | range N from 1 to 5 step 1 |
sort | Sort | T | sort time |
search | Text search for a value | T | search 'foo' |
summarize | Aggregate | T | summarize agg.count() by foo |
union | Query multiple tables | T | union table1, table2 |
visualize | Generate chart | T | visualize line |
where | Filter | T | where foo == bar |
| Data type | Example acceptable values |
|---|---|
| Integer | 1, -1 |
| Double | 1.0, -1.0 |
| String | 'foo', "foo" |
| Boolean | true, false |
| Timestamp | time.parse_timestamp('2023-06-01 13:14:15.00Z'), time.parse_timestamp('2023-06-01') |
| Timespan | 15s, 2d, time.parse_timespan('1d') |
| Object | {key1: value1, key2: value2}, object('key1', 'foo', 'key2', 1) |
| Array | [A, B, C], array('apple', 'orange') |
| Table | tableName |
| Column | columnName |
| Null | null |