PRODUCT
WHY OBSERVE
LEARN
CAREERS
ABOUT US

Hide navigation sidebar

Hide table of contents sidebar

Toggle site navigation sidebar

documentation

Toggle table of contents sidebar

Getting started

Why Observe?
Introducing Observe Concepts
Toggle child pages in navigation
- Advanced Observe Concepts
Getting Started with Observe
Tutorial: Modeling Weather Data

Managing your Workspace

Navigating the Workspace
Toggle child pages in navigation
Observe Apps

Working with Data

About Queries and On-demand Acceleration
Data Ingestion
Toggle child pages in navigation
- Sources
  Toggle child pages in navigation
- Forwarders
  Toggle child pages in navigation
- Datastreams
- Endpoints
  Toggle child pages in navigation
  - HTTP
  - DDTrace
  - Elasticsearch
  - Kinesis
  - LogPlex
  - OpenTelemetry
  - Prometheus
  - Zipkin
- Troubleshooting Data Ingestion
Observe Integrations
Toggle child pages in navigation
- Amazon Web Services (AWS) Integration
  Toggle child pages in navigation
  - Amazon CloudFront
  - Amazon EC2
  - Amazon Elastic Container Service
    Toggle child pages in navigation
    - Amazon Elastic Container Service metrics
  - Amazon RDS
    Toggle child pages in navigation
    - Amazon RDS metrics
  - AWS Lambda
    Toggle child pages in navigation
    - AWS Lambda metrics
  - Elastic Load Balancing
    Toggle child pages in navigation
    - Elastic Load Balancing metrics
- Basic Threat Intel Integration (Public Preview)
  Toggle child pages in navigation
  - Installing the Basic Threat Intel App
  - Using Unified Basic Threat Intel Datasets with Observe
    Toggle child pages in navigation
    - Example: Using Unified Hosts-Domains and URL Threatlists
    - Example: Using Unified IPv4 Threatlists
- Google Cloud Platform (GCP) App
  Toggle child pages in navigation
  - GCP Asset Inventory
  - GCP BigQuery
  - GCP Cloud Functions
    Toggle child pages in navigation
    - GCP Cloud Functions metrics
  - GCP Cloud Load Balancing
    Toggle child pages in navigation
    - GCP Cloud Load Balancing Metrics
  - GCP Cloud Run
    Toggle child pages in navigation
    - GCP Cloud Run metrics
  - GCP Cloud SQL
    Toggle child pages in navigation
    - GCP Cloud SQL metrics
  - GCP Cloud Storage
    Toggle child pages in navigation
    - GCP Cloud Storage metrics
  - GCP Compute
    Toggle child pages in navigation
    - GCP Compute metrics
  - GCP Logging
  - GCP Cloud Metrics
  - Google Kubernetes Engine
  - Memorystore Redis
- GitHub
  Toggle child pages in navigation
- GitLab
  Toggle child pages in navigation
- Host Monitoring
  Toggle child pages in navigation
  - Installing the Host Monitoring App
  - Uninstalling the Host Monitoring App
- Jenkins CI/CD Integration
  Toggle child pages in navigation
  - Installing the Jenkins App
  - Uninstalling the Jenkins App
- Kubernetes
  Toggle child pages in navigation
  - Installing the Kubernetes App
- Microsoft Azure
  Toggle child pages in navigation
- MySQL Database Service
  Toggle child pages in navigation
  - Installing the MySQL DB App
  - Uninstalling the MySQL DB App
- Node Exporter
- OpenAI (Public Preview)
- OpenTelemetry
  Toggle child pages in navigation
  - Installing the Observe OpenTelemetry App
  - Uninstalling the Observe OpenTelemetry App
- PostgreSQL Database Service
  Toggle child pages in navigation
  - Installing the PostgreSQL DB App
  - Uninstalling the PostgreSQL DB App
Observe Datasets and Time
Toggle child pages in navigation
Worksheets

Working with Dashboards

Creating and using dashboards

Configuring Monitors and Alerts

Introduction to Monitors and Alerts
Toggle child pages in navigation
Overview of Shared Actions
Toggle child pages in navigation
- Customizing Alert Messages
- Shared Action Integrations
  Toggle child pages in navigation

Working with metrics

Introduction to Metrics
Metrics Shaping Example: Host System Data
Adding Metrics Using the Expression Builder

Managing an Observe Instance

Using Acceleration Manager with Datasets
Credit Manager
Understanding the Usage Dashboard
Adding Role-based Access Control with Terraform

OPAL Query Language

OPAL — Observe Processing and Analysis Language
Toggle child pages in navigation
OPAL 101 – Getting Started with OPAL
OPAL 102 – Shaping Structured and Unstructured Data Using Stages
All OPAL verbs
Toggle child pages in navigation
- OPAL Verbs By Category
  Toggle child pages in navigation
  - OPAL Aggregate Verbs
    Toggle child pages in navigation
    - aggregate
    - align
    - dedup
    - distinct
    - make_session
    - merge_events
    - rollup
    - statsby
    - timechart
    - bucketize
    - timestats
  - OPAL Filter Verbs
    Toggle child pages in navigation
    - always
    - bottomk
    - ever
    - filter
    - limit
    - never
    - topk
  - OPAL Join Verbs
    Toggle child pages in navigation
    - exists
    - follow
    - fulljoin
    - join
    - leftjoin
    - lookup
    - surrounding
    - union
    - update_resource
  - OPAL Metadata Verbs
    Toggle child pages in navigation
    - add_key
    - interface
    - make_event
    - make_interval
    - make_resource
    - make_session
    - make_table
    - merge_events
    - set_col_enum
    - set_col_immutable
    - set_col_visible
    - set_label
    - set_link
    - set_metric
    - set_primary_key
    - set_pk
    - set_valid_from
    - set_valid_to
    - sort
    - unset_all_links
    - unset_keys
    - unset_link
    - unsort
  - OPAL Metrics Verbs
    Toggle child pages in navigation
    - aggregate
    - align
    - rollup
    - set_metric
  - OPAL Projection Verbs
    Toggle child pages in navigation
  - OPAL Semistructured Verbs
    Toggle child pages in navigation
  - OPAL Deprecated Verb Aliases
    Toggle child pages in navigation
    - addfk
    - addkey
    - addmetric
    - changelog
    - coldrop
    - colenum
    - colimmutable
    - colmake
    - colpick
    - colregex
    - colrename
    - colshow
    - droptime
    - fkdrop
    - flattenall
    - flattenleaves
    - flattensingle
    - makeresource
    - makesession
    - merge_event
    - mergeevent
    - reaggregate
    - setlabel
    - setpk
    - setvf
    - setvt
All OPAL functions
Toggle child pages in navigation
- OPAL Functions By Category
  Toggle child pages in navigation
  - OPAL Aggregate Functions
    Toggle child pages in navigation
    - any
    - any_not_null
    - array_agg
    - array_agg_distinct
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - deriv
    - first
    - first_not_null
    - last
    - last_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - percentile
    - percentile_cont
    - percentile_disc
    - prom_quantile
    - rate
    - stddev
    - string_agg
    - string_agg_distinct
    - sum
  - OPAL Boolean Functions
    Toggle child pages in navigation
    - array_contains
    - bool
    - bool_null
    - contains
    - ends_with
    - eq
    - gt
    - gte
    - in
    - ipv4_address_in_network
    - is_null
    - like
    - lt
    - lte
    - match_regex
    - ne
    - path_exists
    - same
    - search
    - starts_with
  - OPAL Misc Functions
    Toggle child pages in navigation
    - any_null
    - asc
    - coalesce
    - desc
    - frame
    - frame_exact
    - if
    - if_null
    - make_object
    - on
    - order_by
  - OPAL Networking Functions
    Toggle child pages in navigation
  - OPAL Numeric Functions
    Toggle child pages in navigation
    - abs
    - array_length
    - ceil
    - count
    - count_distinct
    - count_distinct_exact
    - dense_rank
    - exp
    - float64
    - float64_null
    - floor
    - hash
    - haversine_distance_km
    - int64
    - int64_null
    - int_div
    - ipv4_network_int64
    - ipv4_to_int64
    - ln
    - log
    - mod
    - numeric_null
    - parse_hex
    - percentile_disc
    - pow
    - prom_quantile
    - rank
    - round
    - row_number
    - sqrt
    - strlen
    - to_days
    - to_hours
    - to_milliseconds
    - to_minutes
    - to_nanoseconds
    - to_seconds
    - to_weeks
    - width_bucket
  - OPAL Regex Functions
    Toggle child pages in navigation
  - OPAL Semistructured Functions
    Toggle child pages in navigation
    - append_item
    - array
    - array_agg
    - array_agg_distinct
    - array_null
    - array_to_string
    - concat_arrays
    - detect_browser
    - drop_fields
    - embed_sql_params
    - get_field
    - get_item
    - get_jmespath
    - get_regex_all
    - index_of_item
    - insert_item
    - make_array
    - make_fields
    - match_regex
    - object
    - object_agg
    - object_keys
    - object_null
    - parse_csv
    - parse_ip
    - parse_json
    - parse_url
    - path_exists
    - pick_fields
    - pivot_array
    - prepend_item
    - slice_array
    - split
    - tokenize
    - unpivot_array
  - OPAL Special Functions
    Toggle child pages in navigation
    - case
    - group_by
    - m
    - metric
    - options
    - primary_key
    - pk
    - valid_for
    - window
  - OPAL String Functions
    Toggle child pages in navigation
    - array_to_string
    - concat_strings
    - contains
    - decode_base64
    - decode_uri
    - decode_uri_component
    - detect_browser
    - editdistance
    - encode_base64
    - encode_uri
    - encode_uri_component
    - format_time
    - get_regex
    - get_regex_all
    - int64_to_ipv4
    - left
    - like
    - lower
    - lpad
    - ltrim
    - match_regex
    - parse_csv
    - parse_kvs
    - parse_timestamp
    - pivot_array
    - position
    - regex
    - replace
    - replace_regex
    - right
    - rpad
    - rtrim
    - search
    - split
    - split_part
    - starts_with
    - string
    - string_agg
    - string_agg_distinct
    - string_null
    - substring
    - tokenize
    - tokenize_part
    - trim
    - unpivot_array
    - upper
    - variant_type_name
  - OPAL Time Functions
    Toggle child pages in navigation
    - abs
    - avg
    - bin_end_time
    - bin_start_time
    - deriv
    - duration
    - duration_hr
    - duration_min
    - duration_ms
    - duration_null
    - duration_sec
    - format_time
    - from_milliseconds
    - timestamp_ms
    - from_nanoseconds
    - timestamp_ns
    - from_seconds
    - timestamp_s
    - median
    - median_exact
    - now
    - parse_isotime
    - parse_timestamp
    - percentile
    - percentile_cont
    - percentile_disc
    - query_end_time
    - query_start_time
    - rate
    - row_end_time
    - row_timestamp
    - stddev
    - sum
    - timestamp_null
    - to_days
    - to_hours
    - to_milliseconds
    - to_minutes
    - to_nanoseconds
    - to_seconds
    - to_weeks
    - valid_for
  - OPAL Window Functions
    Toggle child pages in navigation
    - any
    - any_not_null
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - dense_rank
    - deriv
    - first
    - first_not_null
    - lag
    - lag_not_null
    - last
    - last_not_null
    - lead
    - lead_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - percentile
    - percentile_cont
    - percentile_disc
    - rank
    - rate
    - row_number
    - stddev
    - sum
  - OPAL Deprecated Function Aliases
    Toggle child pages in navigation
    - array_pivot
    - array_unpivot
    - countdistinct
    - countdistinctexact
    - decodebase64
    - denserank
    - encodebase64
    - endswith
    - groupby
    - ifnull
    - isnull
    - makeobject
    - match_regex_all
    - medianexact
    - milliseconds
    - nanoseconds
    - orderby
    - parsehex
    - parseip
    - parseisotime
    - parsejson
    - parsekvs
    - parseurl
    - percentilecont
    - percentiledisc
    - primarykey
    - queryendtime
    - querystarttime
    - regex_match
    - regex_replace
    - row_endtime
    - rownumber
    - seconds
    - startswith
    - strcat
    - string_concat
    - validfor

Reference

Single Sign On (SSO) Configurations for Observe
Toggle child pages in navigation
Observe Glossary
Helpful Hints
FAQ
Units of Measure

Release Notes

Release Notes - June 9, 2023
Toggle child pages in navigation

API Reference

Exporting Query Results in CSV or JSON Format

CLI Reference

Observe Command Line Interface Tool Overview
Toggle child pages in navigation

Terraform Reference

Working with Observe and Terraform
Toggle child pages in navigation

Toggle table of contents sidebar

droptime¶

droptime is a deprecated alias of make_table.

Have comments about the Observe docs?