PRODUCT
WHY OBSERVE
LEARN
CAREERS
ABOUT US

Hide navigation sidebar

Hide table of contents sidebar

Toggle site navigation sidebar

documentation

Toggle table of contents sidebar

Getting started

Why Observe?
Introducing Observe Concepts
Toggle child pages in navigation
- Advanced Observe Concepts
About Queries and On-demand Acceleration
Navigating the Workspace
Toggle child pages in navigation
Getting Started with Observe

Tutorials

Tutorial: Modeling Weather Data
Tutorial: Creating a Single Stat Dashboard
OPAL 101 – Getting Started with OPAL
OPAL 102 – Shaping Structured and Unstructured Data Using Stages

Working with Data

Data Ingestion
Toggle child pages in navigation
- Sources
  Toggle child pages in navigation
- Forwarders
  Toggle child pages in navigation
- Datastreams
- Endpoints
  Toggle child pages in navigation
  - HTTP
  - DDTrace
  - Elasticsearch
  - Kinesis
  - LogPlex
  - OpenTelemetry
  - Prometheus
  - Zipkin
- Troubleshooting Data Ingestion
Observe Integrations
Toggle child pages in navigation
- Observe Apps
- Amazon Web Services (AWS) Integration
  Toggle child pages in navigation
  - Amazon CloudFront
  - Amazon EC2
  - Amazon Elastic Container Service
    Toggle child pages in navigation
    - Amazon Elastic Container Service Metrics
  - Amazon RDS
    Toggle child pages in navigation
    - Amazon RDS Metrics
  - AWS Lambda
    Toggle child pages in navigation
    - AWS Lambda metrics
  - Elastic Load Balancing
    Toggle child pages in navigation
    - Elastic Load Balancing Metrics
- Basic Threat Intel Integration
  Toggle child pages in navigation
  - Installing the Basic Threat Intel App
  - Using Unified Basic Threat Intel Datasets with Observe
    Toggle child pages in navigation
- Google Cloud Platform (GCP) App
  Toggle child pages in navigation
  - GCP Asset Inventory
  - GCP BigQuery
  - GCP Cloud Functions
    Toggle child pages in navigation
    - GCP Cloud Functions metrics
  - GCP Cloud Load Balancing
    Toggle child pages in navigation
    - GCP Cloud Load Balancing Metrics
  - GCP Cloud Run
    Toggle child pages in navigation
    - GCP Cloud Run Metrics
  - GCP Cloud SQL
    Toggle child pages in navigation
    - GCP Cloud SQL Metrics
  - GCP Cloud Storage
    Toggle child pages in navigation
    - GCP Cloud Storage Metrics
  - GCP Compute
    Toggle child pages in navigation
    - GCP Compute Metrics
  - GCP Logging
  - GCP Cloud Metrics
  - Google Kubernetes Engine
  - Memorystore Redis
- GitHub
  Toggle child pages in navigation
- GitLab
  Toggle child pages in navigation
- Host Monitoring
  Toggle child pages in navigation
  - Installing the Host Monitoring App
    Toggle child pages in navigation
  - Uninstalling the Host Monitoring App
- Jenkins CI/CD Integration
  Toggle child pages in navigation
  - Installing the Jenkins App
  - Uninstalling the Jenkins App
- Kubernetes
  Toggle child pages in navigation
  - Installing the Kubernetes App
- Microsoft Azure
  Toggle child pages in navigation
- MongoDB Atlas
  Toggle child pages in navigation
  - Installing the MongoDB Atlas App
  - Updating the MongoDB Atlas App and Poller
- MySQL Database Service
  Toggle child pages in navigation
  - Installing the MySQL DB App
  - Uninstalling the MySQL DB App
- Node Exporter
- OpenAI (Public Preview)
- OpenTelemetry
  Toggle child pages in navigation
  - Installing the Observe OpenTelemetry App
  - Uninstalling the Observe OpenTelemetry App
- Orca Security App (Public Preview)
  Toggle child pages in navigation
  - Installing the Orca Security App
- PostgreSQL Database Service
  Toggle child pages in navigation
  - Installing the PostgreSQL DB App
  - Uninstalling the PostgreSQL DB App
- Prometheus Metrics (Public Preview)
  Toggle child pages in navigation
  - Installing the Prometheus Metrics App
  - Tutorial: Getting Started with Observe and Prometheus
- Security Onion App (Public Preview)
  Toggle child pages in navigation
  - Installing the Security Onion App
- Service Level Objectives (SLOs)
  Toggle child pages in navigation
  - Installing the Service Level Objective App
Observe Datasets and Time
Toggle child pages in navigation
Worksheets

Working with Dashboards

Creating Dashboards
URL Query Parameters

Configuring Monitors and Alerts

Introduction to Monitors and Alerts
Toggle child pages in navigation
Overview of Shared Actions
Toggle child pages in navigation
- Customizing Alert Messages
- Shared Action Integrations
  Toggle child pages in navigation

Using Explorer for Logs and Metrics

Using the Observe Log Explorer
Working with the Metrics Explorer

Working with metrics

Introduction to Metrics
Toggle child pages in navigation
- Adding Metrics Using the Metrics Expression Builder
- Metrics Shaping Example: Host System Data

OPAL Query Language

OPAL — Observe Processing and Analysis Language
Toggle child pages in navigation
All OPAL verbs
Toggle child pages in navigation
- OPAL Verbs By Category
  Toggle child pages in navigation
  - OPAL Aggregate Verbs
    Toggle child pages in navigation
    - aggregate
    - align
    - dedup
    - distinct
    - make_session
    - merge_events
    - rollup
    - statsby
    - timechart
    - bucketize
    - timestats
  - OPAL Filter Verbs
    Toggle child pages in navigation
    - always
    - bottomk
    - ever
    - filter
    - limit
    - never
    - topk
  - OPAL Join Verbs
    Toggle child pages in navigation
    - exists
    - follow
    - fulljoin
    - join
    - leftjoin
    - lookup
    - surrounding
    - union
    - update_resource
  - OPAL Metadata Verbs
    Toggle child pages in navigation
  - OPAL Metrics Verbs
    Toggle child pages in navigation
    - aggregate
    - align
    - rollup
    - set_metric
  - OPAL Projection Verbs
    Toggle child pages in navigation
  - OPAL Semistructured Verbs
    Toggle child pages in navigation
  - OPAL Deprecated Verb Aliases
    Toggle child pages in navigation
    - addfk
    - addkey
    - addmetric
    - changelog
    - coldrop
    - colenum
    - colimmutable
    - colmake
    - colpick
    - colregex
    - colrename
    - colshow
    - droptime
    - fkdrop
    - flattenall
    - flattenleaves
    - flattensingle
    - makeresource
    - makesession
    - merge_event
    - mergeevent
    - reaggregate
    - setlabel
    - setpk
    - setvf
    - setvt
All OPAL functions
Toggle child pages in navigation
- OPAL Functions By Category
  Toggle child pages in navigation
  - OPAL Aggregate Functions
    Toggle child pages in navigation
    - any
    - any_not_null
    - array_agg
    - array_agg_distinct
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - deriv
    - first
    - first_not_null
    - last
    - last_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - percentile
    - percentile_cont
    - percentile_disc
    - prom_quantile
    - rate
    - stddev
    - string_agg
    - string_agg_distinct
    - sum
    - topk_agg
  - OPAL Boolean Functions
    Toggle child pages in navigation
    - array_contains
    - bool
    - bool_null
    - contains
    - ends_with
    - eq
    - gt
    - gte
    - in
    - ipv4_address_in_network
    - is_null
    - like
    - lt
    - lte
    - match_regex
    - ne
    - path_exists
    - same
    - search
    - starts_with
  - OPAL Misc Functions
    Toggle child pages in navigation
    - asc
    - coalesce
    - desc
    - frame
    - frame_exact
    - if
    - if_null
    - nullsfirst
    - nullslast
    - on
    - order_by
    - sort_array
    - variant_null
  - OPAL Networking Functions
    Toggle child pages in navigation
  - OPAL Numeric Functions
    Toggle child pages in navigation
    - abs
    - array_length
    - ceil
    - count
    - count_distinct
    - count_distinct_exact
    - dense_rank
    - exp
    - float64
    - float64_null
    - floor
    - hash
    - haversine_distance_km
    - index_of_item
    - int64
    - int64_null
    - int_div
    - ipv4_network_int64
    - ipv4_to_int64
    - ln
    - log
    - mod
    - numeric_null
    - parse_hex
    - percentile_disc
    - pow
    - prom_quantile
    - rank
    - round
    - row_number
    - sqrt
    - strlen
    - to_days
    - to_hours
    - to_milliseconds
    - to_minutes
    - to_nanoseconds
    - to_seconds
    - to_weeks
    - width_bucket
  - OPAL Regex Functions
    Toggle child pages in navigation
  - OPAL Semistructured Functions
    Toggle child pages in navigation
    - append_item
    - array
    - array_agg
    - array_agg_distinct
    - array_max
    - array_min
    - array_null
    - array_to_string
    - concat_arrays
    - detect_browser
    - drop_fields
    - embed_sql_params
    - get_field
    - get_item
    - get_jmespath
    - get_regex_all
    - index_of_item
    - insert_item
    - make_array
    - make_array_range
    - make_fields
    - make_object
    - match_regex
    - merge_objects
    - object
    - object_agg
    - object_keys
    - object_null
    - parse_csv
    - parse_ip
    - parse_json
    - parse_url
    - path_exists
    - pick_fields
    - pivot_array
    - prepend_item
    - slice_array
    - split
    - tokenize
    - topk_agg
    - unpivot_array
  - OPAL Special Functions
    Toggle child pages in navigation
    - case
    - group_by
    - m
    - metric
    - options
    - primary_key
    - pk
    - valid_for
    - window
  - OPAL String Functions
    Toggle child pages in navigation
    - array_to_string
    - concat_strings
    - decode_base64
    - decode_uri
    - decode_uri_component
    - detect_browser
    - editdistance
    - embed_sql_params
    - encode_base64
    - encode_uri
    - encode_uri_component
    - format_time
    - get_regex
    - get_regex_all
    - int64_to_ipv4
    - left
    - like
    - lower
    - lpad
    - ltrim
    - match_regex
    - parse_csv
    - parse_kvs
    - parse_timestamp
    - pivot_array
    - position
    - regex
    - replace
    - replace_regex
    - right
    - rpad
    - rtrim
    - search
    - split
    - split_part
    - starts_with
    - string
    - string_agg
    - string_agg_distinct
    - string_null
    - substring
    - tokenize
    - tokenize_part
    - trim
    - unpivot_array
    - upper
    - variant_type_name
  - OPAL Time Functions
    Toggle child pages in navigation
    - abs
    - avg
    - bin_end_time
    - bin_start_time
    - deriv
    - duration
    - duration_hr
    - duration_min
    - duration_ms
    - duration_null
    - duration_sec
    - format_time
    - from_milliseconds
    - timestamp_ms
    - from_nanoseconds
    - timestamp_ns
    - from_seconds
    - timestamp_s
    - median
    - median_exact
    - now
    - parse_duration
    - parse_isotime
    - parse_timestamp
    - percentile
    - percentile_cont
    - percentile_disc
    - query_end_time
    - query_start_time
    - rate
    - row_end_time
    - row_timestamp
    - stddev
    - sum
    - timestamp_null
    - to_days
    - to_hours
    - to_milliseconds
    - to_minutes
    - to_nanoseconds
    - to_seconds
    - to_weeks
    - valid_for
  - OPAL Window Functions
    Toggle child pages in navigation
    - any
    - any_not_null
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - dense_rank
    - deriv
    - first
    - first_not_null
    - lag
    - lag_not_null
    - last
    - last_not_null
    - lead
    - lead_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - percentile
    - percentile_cont
    - percentile_disc
    - rank
    - rate
    - row_number
    - stddev
    - sum
    - topk_agg
  - OPAL Deprecated Function Aliases
    Toggle child pages in navigation
    - any_null
    - array_pivot
    - array_unpivot
    - countdistinct
    - countdistinctexact
    - decodebase64
    - denserank
    - encodebase64
    - endswith
    - groupby
    - ifnull
    - isnull
    - makeobject
    - match_regex_all
    - medianexact
    - milliseconds
    - nanoseconds
    - orderby
    - parsehex
    - parseip
    - parseisotime
    - parsejson
    - parsekvs
    - parseurl
    - percentilecont
    - percentiledisc
    - primarykey
    - queryendtime
    - querystarttime
    - regex_match
    - regex_replace
    - row_endtime
    - rownumber
    - seconds
    - startswith
    - strcat
    - string_concat
    - validfor

Managing an Observe Instance

Using Acceleration Manager with Datasets
Credit Manager
Understanding the Usage Dashboard
Adding Role-Based Access Control with Terraform

Release Notes

Release Notes
Toggle child pages in navigation

Developers Documentation

Exporting Query Results in CSV or JSON Format
Observe Command Line Interface Tool Overview
Toggle child pages in navigation
Working with Observe and Terraform
Toggle child pages in navigation

Single Sign On Configurations

Single Sign On (SSO) Configurations for Observe
Toggle child pages in navigation

Reference

Observe Glossary
Units of Measure

Toggle table of contents sidebar

string_concat¶

string_concat is a deprecated alias of concat_strings.

Have comments about the Observe docs?