All OPAL verbs#

Opal verbs process sets of rows of columns.

Verb

Description

add_key

Add a candidate key to the output.

aggregate

Aggregates metrics across tag dimensions.

align

Align raw metrics onto a time grid (defined by the input period) by aggregating nearby data points together.

always

When the verb input is a Resource dataset, always selects all resources that matched the predicate at all times.

bottomk

Selects all data for each of the bottom k ranked groups.

dedup

dedup collapses all rows in a dataset with the same timestamp and identical values in specified columns to one row.

drop_col

Exclude one or more columns from the input dataset to the output dataset.

drop_interface

Removes one or more interface implementations from the current dataset.

ever

When the verb input is a Resource dataset, ever selects all resources that at some point matched the predicate.

exists

Return the rows from the default dataset that have a match anywhere in the query time window.

extract_regex

Add one or more columns by matching capture names in a regular expression against a given source expression.

filter

Exclude rows from the input dataset that do not match the given predicate expression.

filter_last

Exclude rows from the input dataset that do not match the given predicate expression.

flatten

Given an object or array input, recursively flatten all child elements into key-value columns, with null intermediates.

flatten_all

Given an object or array input, recursively flatten all child and intermediate elements into key-value columns.

flatten_leaves

Given an object or array input, recursively flatten all child elements into key-value columns, returning only leaf values.

flatten_single

Given an object or array input, flatten the first level of child elements into key-value columns.

follow

Return the rows from the additional joined dataset that have a match anywhere in the query time window.

follow_not

Return the rows from the joined dataset that do not have a match anywhere in the query time window.

fulljoin

Temporal full join, adding new columns in the output dataset.

histogram

Generate an equi-width histogram for the selected expression.

interface

Map fields of this dataset to a pre-defined interface.

join

Temporal inner join, adding new columns in the output dataset.

leftjoin

Temporal left join, adding new columns in the output dataset.

limit

Select the first count rows based on the current ordering of the input and filter out the rest.

lookup

Find matching rows in a Resource or Interval dataset, making new columns in the output dataset.

lookup_ip_info

Using a value or column of type IPv4, look up corresponding fields associated with the IP address.

make_col

Add one or more new columns from the input dataset to the output dataset.

make_event

Creates an Event dataset from an input Table, Interval, or Resource dataset.

make_interval

Creates an Interval dataset from an input Table, Event, or Resource dataset.

make_resource

Creates a Resource dataset from an input Event or Interval dataset.

make_session

Group events or intervals that are close to each other into sessions, and calculate aggregations over each session.

make_table

Creates a Table dataset from an input Event, Interval, or Resource dataset.

merge_events

Merge consecutive events into new events based on merge conditions.

never

When the verb input is a Resource dataset, never selects all resources that at no point matched the predicate.

not_exists

Return the rows from the default dataset that do not have a match anywhere in the query time window.

pick_col

Exclude all columns except the specified columns from the input dataset to the output dataset.

pivot

The pivot verb rotates a table by transforming rows into columns.

rename_col

Renames a column.

rollup

Rollup raw metrics into aligned metrics.

set_col_enum

Mark specified columns as enumerations, or not, so that the user interface can present them appropriately.

set_col_immutable

Mark resource columns as time immutable (time-invariant), or not.

set_col_searchable

Include or exclude columns from any future full-text search operation (e.

set_col_visible

Show or hide columns by name.

set_label

Declare the ‘label’ of the output to be the designated column.

set_link

Add a foreign key to the output, which identifies the target dataset and columns used to find a target resource.

set_metric

Register a metric, with its metadata defined in an options object.

set_metric_metadata

Specify the dataset that stores the metadata of the metrics defined in the current dataset.

set_primary_key

Declare the primary key of the output as consisting of one or more named columns.

set_valid_from

Declare the valid from of the output to be the named column, which must be a timestamp column.

set_valid_to

Declare the valid to of the output to be the named column, which must be a timestamp column.

sort

Sort rows in the dataset based on ordering functions applied to column fields or column name provided as arguments.

statsby

Calculate statistics of columns with aggregate functions, based on (optional) grouping columns.

surrounding

Outer joins datasets by matching row time to a specified frame as well as column values.

timechart

Bin (in time) and aggregate point or interval table columns through time, based on (optional) grouping columns.

timestats

Aggregate columns at every point in time, based on (optional) grouping columns.

topk

Selects all data for each of the top k ranked groups.

union

Create a new dataset consisting of the rows from the main input and each of the arguments.

unpivot

The unpivot verb rotates a table by transforming a list of columns into rows.

unset_all_links

Drop all outbound links without having to specify the individual labels.

unset_keys

Remove the primary and candidate key declarations from the dataset.

unset_link

Drop a foreign key by specifying the foreign keys label.

unsort

Remove all column sort ordering metadata that may have been inserted by the sort verb.

update_resource

Augments the input Resource dataset using events from another dataset.

Aliases

Aliases work as alternative names for their main verb. Users of certain other query languages may be more comfortable with these alternative names. Alias names on this list can always be used whenever the main name can be used.