PRODUCT
LEARN
CAREERS
ABOUT US

Hide navigation sidebar

Hide table of contents sidebar

Toggle site navigation sidebar

documentation

Toggle table of contents sidebar

Learn About Observe

Introducing Observe Concepts
Toggle child pages in navigation
- Advanced Observe Concepts
About Queries and On-demand Acceleration
Navigating the Workspace
Toggle child pages in navigation
Observe Datasets and Time
Toggle child pages in navigation

Getting Started with Observe

Getting Started with Observe
Tutorial: Modeling Weather Data
OPAL 101 – Getting Started with OPAL
OPAL 102 – Shaping Structured and Unstructured Data Using Stages

Investigate Logs and Metrics

Investigating Logs with the Observe Log Explorer
Working with the Metrics Explorer

Observe Integrations

Observe Integrations
Toggle child pages in navigation
- Observe Apps
- Amazon Web Services (AWS) Integration
  Toggle child pages in navigation
  - Amazon CloudFront
  - Amazon EC2
  - Amazon Elastic Container Service
    Toggle child pages in navigation
    - Amazon Elastic Container Service Metrics
  - Amazon RDS
    Toggle child pages in navigation
    - Amazon RDS Metrics
  - AWS Lambda
    Toggle child pages in navigation
    - AWS Lambda metrics
  - Elastic Load Balancing
    Toggle child pages in navigation
    - Elastic Load Balancing Metrics
- Basic Threat Intel Integration
  Toggle child pages in navigation
  - Installing the Basic Threat Intel App
  - Using Unified Basic Threat Intel Datasets with Observe
    Toggle child pages in navigation
- Google Cloud Platform (GCP) App
  Toggle child pages in navigation
  - GCP Asset Inventory
  - GCP BigQuery
  - GCP Cloud Functions
    Toggle child pages in navigation
    - GCP Cloud Functions metrics
  - GCP Cloud Load Balancing
    Toggle child pages in navigation
    - GCP Cloud Load Balancing Metrics
  - GCP Cloud Run
    Toggle child pages in navigation
    - GCP Cloud Run Metrics
  - GCP Cloud SQL
    Toggle child pages in navigation
    - GCP Cloud SQL Metrics
  - GCP Cloud Storage
    Toggle child pages in navigation
    - GCP Cloud Storage Metrics
  - GCP Compute
    Toggle child pages in navigation
    - GCP Compute Metrics
  - GCP Logging
  - GCP Cloud Metrics
  - Google Kubernetes Engine
  - Memorystore Redis
- GitHub
  Toggle child pages in navigation
- GitLab
  Toggle child pages in navigation
- Host Monitoring
  Toggle child pages in navigation
  - Installing the Host Monitoring App
    Toggle child pages in navigation
  - Uninstalling the Host Monitoring App
- Jenkins CI/CD Integration
  Toggle child pages in navigation
  - Installing the Jenkins App
  - Uninstalling the Jenkins App
- Kubernetes
  Toggle child pages in navigation
  - Installing the Kubernetes App
- Microsoft Azure
  Toggle child pages in navigation
- MongoDB Atlas
  Toggle child pages in navigation
  - Installing the MongoDB Atlas App
  - Updating the MongoDB Atlas App and Poller
- MySQL Database Service
  Toggle child pages in navigation
  - Installing the MySQL DB App
  - Uninstalling the MySQL DB App
- Node Exporter
- OpenAI (Public Preview)
- OpenTelemetry
  Toggle child pages in navigation
- Orca Security App (Public Preview)
  Toggle child pages in navigation
  - Installing the Orca Security App
- PostgreSQL Database Service
  Toggle child pages in navigation
  - Installing the PostgreSQL DB App
  - Uninstalling the PostgreSQL DB App
- Prometheus Metrics (Public Preview)
  Toggle child pages in navigation
  - Installing the Prometheus Metrics App
  - Tutorial: Getting Started with Observe and Prometheus
- Security Onion App (Public Preview)
  Toggle child pages in navigation
  - Installing the Security Onion App
- Service Level Objectives (SLOs)
  Toggle child pages in navigation
  - Installing the Service Level Objective App

Data Ingestion

Datastreams
Endpoints
Toggle child pages in navigation
Forwarders
Toggle child pages in navigation
Sources
Toggle child pages in navigation
Troubleshooting Data Ingestion
Worksheets

Explore Your Data

Exploring and Creating Dashboards
URL Query Parameters

Creating Alerts and Monitors

Introduction to Monitors and Alerts
Toggle child pages in navigation
Overview of Shared Actions
Toggle child pages in navigation
- Customizing Alert Messages
- Shared Action Integrations
  Toggle child pages in navigation

OPAL Query Language

OPAL — Observe Processing and Analysis Language
Toggle child pages in navigation
All OPAL verbs
Toggle child pages in navigation
- OPAL Verbs By Category
  Toggle child pages in navigation
  - OPAL Aggregate Verbs
    Toggle child pages in navigation
    - aggregate
    - align
    - dedup
    - distinct
    - make_session
    - merge_events
    - pivot
    - rollup
    - statsby
    - timechart
    - bucketize
    - timestats
    - unpivot
  - OPAL Filter Verbs
    Toggle child pages in navigation
    - always
    - bottomk
    - ever
    - filter
    - filter_last
    - limit
    - never
    - topk
  - OPAL Join Verbs
    Toggle child pages in navigation
    - exists
    - follow
    - fulljoin
    - join
    - leftjoin
    - lookup
    - surrounding
    - union
    - update_resource
  - OPAL Metadata Verbs
    Toggle child pages in navigation
  - OPAL Metrics Verbs
    Toggle child pages in navigation
    - aggregate
    - align
    - rollup
    - set_metric
  - OPAL Projection Verbs
    Toggle child pages in navigation
  - OPAL Semistructured Verbs
    Toggle child pages in navigation
  - OPAL Deprecated Verb Aliases
    Toggle child pages in navigation
    - addfk
    - addkey
    - addmetric
    - changelog
    - coldrop
    - colenum
    - colimmutable
    - colmake
    - colpick
    - colregex
    - colrename
    - colshow
    - droptime
    - fkdrop
    - flattenall
    - flattenleaves
    - flattensingle
    - makeresource
    - makesession
    - merge_event
    - mergeevent
    - reaggregate
    - setlabel
    - setpk
    - setvf
    - setvt
All OPAL functions
Toggle child pages in navigation
- OPAL Functions By Category
  Toggle child pages in navigation
  - OPAL Aggregate Functions
    Toggle child pages in navigation
    - any
    - any_not_null
    - array_agg
    - array_agg_distinct
    - array_union_agg
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - deriv
    - first
    - first_not_null
    - last
    - last_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - percentile
    - percentile_cont
    - percentile_disc
    - prom_quantile
    - rate
    - stddev
    - string_agg
    - string_agg_distinct
    - sum
    - topk_agg
  - OPAL Boolean Functions
    Toggle child pages in navigation
    - array_contains
    - arrays_overlap
    - bool
    - bool_null
    - contains
    - ends_with
    - eq
    - gt
    - gte
    - in
    - ipv4_address_in_network
    - is_null
    - like
    - lt
    - lte
    - match_regex
    - ne
    - path_exists
    - same
    - search
    - starts_with
  - OPAL Misc Functions
    Toggle child pages in navigation
    - array_distinct
    - asc
    - coalesce
    - desc
    - frame
    - frame_exact
    - if
    - if_null
    - nullsfirst
    - nullslast
    - on
    - order_by
    - sort_array
    - variant_null
  - OPAL Networking Functions
    Toggle child pages in navigation
  - OPAL Numeric Functions
    Toggle child pages in navigation
    - abs
    - array_length
    - ceil
    - count
    - count_distinct
    - count_distinct_exact
    - dense_rank
    - exp
    - float64
    - float64_null
    - floor
    - hash
    - haversine_distance_km
    - index_of_item
    - int64
    - int64_null
    - int_div
    - ipv4_network_int64
    - ipv4_to_int64
    - ln
    - log
    - mod
    - numeric_null
    - parse_hex
    - percentile_disc
    - pow
    - prom_quantile
    - rank
    - round
    - row_number
    - sqrt
    - strlen
    - to_days
    - to_hours
    - to_milliseconds
    - to_minutes
    - to_nanoseconds
    - to_seconds
    - to_weeks
    - width_bucket
  - OPAL Regex Functions
    Toggle child pages in navigation
  - OPAL Semistructured Functions
    Toggle child pages in navigation
    - append_item
    - array
    - array_agg
    - array_agg_distinct
    - array_max
    - array_min
    - array_null
    - array_to_string
    - array_union_agg
    - arrays_overlap
    - concat_arrays
    - detect_browser
    - drop_fields
    - embed_sql_params
    - get_field
    - get_item
    - get_jmespath
    - get_regex_all
    - index_of_item
    - insert_item
    - make_array
    - make_array_range
    - make_fields
    - make_object
    - merge_objects
    - object
    - object_agg
    - object_keys
    - object_null
    - parse_csv
    - parse_ip
    - parse_json
    - parse_kvs
    - parse_url
    - pick_fields
    - pivot_array
    - prepend_item
    - slice_array
    - split
    - tokenize
    - topk_agg
    - unpivot_array
  - OPAL Special Functions
    Toggle child pages in navigation
    - case
    - group_by
    - m
    - metric
    - options
    - primary_key
    - pk
    - valid_for
    - window
  - OPAL String Functions
    Toggle child pages in navigation
    - array_to_string
    - concat_strings
    - decode_base64
    - decode_uri
    - decode_uri_component
    - detect_browser
    - editdistance
    - embed_sql_params
    - encode_base64
    - encode_uri
    - encode_uri_component
    - format_time
    - get_regex
    - int64_to_ipv4
    - left
    - like
    - lower
    - lpad
    - ltrim
    - parse_csv
    - parse_kvs
    - parse_timestamp
    - pivot_array
    - position
    - regex
    - replace
    - replace_regex
    - right
    - rpad
    - rtrim
    - search
    - split
    - split_part
    - string
    - string_agg
    - string_agg_distinct
    - string_null
    - substring
    - tokenize
    - tokenize_part
    - trim
    - unpivot_array
    - upper
    - variant_type_name
  - OPAL Time Functions
    Toggle child pages in navigation
    - abs
    - avg
    - bin_end_time
    - bin_start_time
    - deriv
    - duration
    - duration_hr
    - duration_min
    - duration_ms
    - duration_null
    - duration_sec
    - format_time
    - from_milliseconds
    - timestamp_ms
    - from_nanoseconds
    - timestamp_ns
    - from_seconds
    - timestamp_s
    - median
    - median_exact
    - now
    - parse_duration
    - parse_isotime
    - parse_timestamp
    - percentile
    - percentile_cont
    - percentile_disc
    - query_end_time
    - query_start_time
    - rate
    - row_end_time
    - row_timestamp
    - row_start_time
    - stddev
    - sum
    - timestamp_null
    - to_days
    - to_hours
    - to_milliseconds
    - to_minutes
    - to_nanoseconds
    - to_seconds
    - to_weeks
    - valid_for
  - OPAL Window Functions
    Toggle child pages in navigation
    - any
    - any_not_null
    - array_union_agg
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - dense_rank
    - deriv
    - first
    - first_not_null
    - lag
    - lag_not_null
    - last
    - last_not_null
    - lead
    - lead_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - percentile
    - percentile_cont
    - percentile_disc
    - rank
    - rate
    - row_number
    - stddev
    - sum
    - topk_agg
  - OPAL Deprecated Function Aliases
    Toggle child pages in navigation
    - any_null
    - array_pivot
    - array_unpivot
    - countdistinct
    - countdistinctexact
    - decodebase64
    - denserank
    - encodebase64
    - endswith
    - groupby
    - ifnull
    - isnull
    - makeobject
    - match_regex_all
    - medianexact
    - milliseconds
    - nanoseconds
    - orderby
    - parsehex
    - parseip
    - parseisotime
    - parsejson
    - parsekvs
    - parseurl
    - percentilecont
    - percentiledisc
    - primarykey
    - queryendtime
    - querystarttime
    - regex_match
    - regex_replace
    - row_endtime
    - rownumber
    - seconds
    - startswith
    - strcat
    - string_concat
    - validfor

Manage Your Observe Instance

Using Acceleration Manager with Datasets
Credit Manager
Understanding the Usage Dashboard
Adding Role-Based Access Control with Terraform

Release Notes

Release Notes
Toggle child pages in navigation

Developers Documentation

Exporting Query Results in CSV or JSON Format
Observe Command Line Interface Tool Overview
Toggle child pages in navigation
Working with Observe and Terraform
Toggle child pages in navigation
Snowflake Outbound Sharing

Single Sign-On Configurations

Single Sign On (SSO) Configurations for Observe
Toggle child pages in navigation

Reference

Observe Glossary
Units of Measure

Toggle table of contents sidebar

merge_event¶

merge_event is a deprecated alias of update_resource.

Have comments about the Observe docs?