• PRODUCT
  • LEARN
    • BLOG
    • RESOURCES
    • DOCS
    • OBSERVABILITY COURSE
  • CAREERS
  • ABOUT US
Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
Observability Cloud documentation
Light Logo Dark Logo

Welcome to Observe

  • Get started with Observe
  • Get help with Observe
  • Observe tutorials
    • Tutorial: Modeling weather data
    • Tutorial: Search for improbable travel
    • Tutorial: Create a single stat dashboard
    • Tutorial: Using O11y Slack to manage an incident
    • Tutorial: Shaping metrics
    • Tutorial: Aggregated metrics shaping
    • Tutorial: Shape host system metrics
    • OPAL 101 – Getting started with OPAL
    • OPAL 102 – Shaping structured and unstructured data using stages
    • Tutorial: Batch ingestion with Observe
  • What’s new

Send Data to Observe

  • Observe Agent
    • What’s new
    • Install Observe Agent on Kubernetes
      • Collect annotations and labels
      • Add or delete attributes
      • Prometheus autodiscovery
      • Filter logs or metrics
      • Handle multiline log records
      • Mask sensitive data
      • Collect Statsd metrics
      • Collect Statsd metrics using UDS
      • Node Affinity, Taints, and Tolerations
      • Deploy the Observe Agent to multiple Kubernetes clusters using Rancher
      • Tune service resource requests and limits
    • Install Observe Agent on Linux
    • Install Observe Agent on macOS
    • Install Observe Agent on Windows
    • Install Observe Agent using Ansible on Linux
    • Install Observe Agent using Ansible on Windows
    • Install Observe Agent on Amazon ECS (EC2)
    • Install Observe Agent on Amazon ECS (Fargate)
    • Docker
    • Configuration
    • Troubleshooting
    • Versioning
      • Upgrade to Observe Agent v1.0.0
      • Upgrade to Observe Agent v2.0.0
  • APM instrumentation
    • Send Java application data to Observe
    • Send .NET application data to Observe
    • Send Node.js application data to Observe
    • Send Python application data to Observe
    • Send Ruby application data to Observe
    • Auto-Instrumentation with OpenTelemetry Operator in Kubernetes
  • LLM instrumentation
    • Node.js (server) instrumentation for LLM observability
    • Python instrumentation for LLM observability
    • Instrumenting other languages for LLM observability
  • RUM instrumentation
    • Using CDN script tags
    • Instrument using the NPM package
  • Integrations
    • Observe apps
    • Amazon Web Services (AWS)
      • Amazon Web Services (AWS) Integration [Legacy]
      • Amazon CloudFront
      • Amazon EC2
      • Amazon Elastic Container Service
        • Amazon Elastic Container Service Metrics
        • Amazon Elastic Container Log Collection
      • Amazon RDS
        • Amazon RDS Metrics
      • AWS Lambda
        • AWS Lambda metrics
      • Elastic Load Balancing
        • Elastic Load Balancing Metrics
    • AWS Quickstart
    • Basic threat intel integration
      • Install the basic threat intel app
      • Use unified basic threat intel Datasets with Observe
        • Example: Use unified hosts-domains and URL threatlists
        • Example: Use unified IPv4 threatlists
        • Example: Use unified IPv4 IAAS providers list
    • Snowflake observability
      • Observe for Snowflake components
      • Prepare Observe to receive Snowflake data
      • Create virtual warehouse to run Observe for Snowflake
      • Install the Observe for Snowflake application
      • Configure the Observe for Snowflake application
      • Send data from Snowflake to Observe
      • Snowflake data in Observe
      • Manage Snowflake with Observe
    • Drata app (public preview)
      • Install the Drata app
    • Fastly (public preview)
      • Install the Fastly app
      • Uninstall the Fastly app
    • Google Cloud Platform (GCP) App [Legacy]
      • GCP Asset Inventory
      • GCP BigQuery
      • GCP Cloud Functions
        • GCP Cloud Functions metrics
      • GCP Cloud Load Balancing
        • GCP Cloud Load Balancing Metrics
      • GCP Cloud Run
        • GCP Cloud Run Metrics
      • GCP Cloud SQL
        • GCP Cloud SQL Metrics
      • GCP Cloud Storage
        • GCP Cloud Storage Metrics
      • GCP Compute
        • GCP Compute Metrics
      • GCP logging
      • GCP cloud metrics
      • Google Kubernetes Engine
      • Memorystore Redis
    • Google Cloud Platform quickstart
      • Google Cloud Platform (GCP) ingesting data
    • GitHub
      • Install the GitHub app
      • Uninstall the GitHub app
      • Upgrade to GitHub app v0.7.0
    • GitLab
      • Install the GitLab app
      • Uninstall the GitLab app
      • Upgrade the GitLab app to v0.4.0
    • Host Monitoring [Legacy]
      • Install the Host Monitoring app
        • Install Host Monitoring on Linux
        • Install Host Monitoring on Windows
        • Install Host Monitoring on MacOS
      • Uninstall the Host Monitoring app
    • Host Quickstart
    • Jenkins CI/CD integration
      • Install the Jenkins app
      • Uninstall the Jenkins app
    • Kubernetes
      • Install the Kubernetes app
      • Collect pod metrics and cAdvisor metrics
    • Microsoft Azure
      • Azure Active Directory (AD)
      • Azure app services
      • Azure cognitive services
      • Azure functions
      • Azure Kubernetes Service (AKS)
      • Azure SQL database
      • Azure SQL managed instances
      • Azure storage account
      • Azure virtual machines
      • Uninstall the Microsoft Azure app
    • MongoDB Atlas
      • Install the MongoDB Atlas app
      • Update the MongoDB Atlas app and poller
    • MySQL Database Service
      • Install the MySQL DB app
      • Uninstall the MySQL DB app
    • Prometheus Node Exporter
    • OpenAI (deprecated)
    • Orca Security app (public preview)
      • Install the Orca Security app
    • PostgreSQL Database Service
      • Install the PostgreSQL DB app
      • Uninstall the PostgreSQL DB app
    • Prometheus metrics (public preview)
      • Install the Prometheus Metrics app
      • Tutorial: Gett started with Observe and Prometheus
    • Security Onion app (public preview)
      • Install the Security Onion app
    • Service level objectives (SLOs)
      • Install the Service Level Objective app
  • Data ingestion
    • Datastreams
    • Sources
      • Amazon API Gateway logs
      • Amazon S3
      • Amazon S3 Bucket Access Logs
      • AWS AppSync
      • AWS CloudTrail
      • Amazon EventBridge
      • Amazon CloudWatch Metrics Streams
      • Amazon CloudWatch logs
      • GitHub
      • Google Workspace audit logs
      • Jira tickets
      • Webhook
      • Windows servers
      • Zendesk tickets
    • Forwarders
      • Amazon Kinesis Firehose
      • Elastic Beats
      • Fluent Bit
      • Fluentd
      • Log4j
      • Logstash
      • Observe Lambda
      • OpenTelemetry Collector
      • Prometheus
      • Telegraf
    • Endpoints
      • Datadog Metrics
      • Elasticsearch
      • HTTP
      • Kinesis
      • OpenTelemetry
      • Prometheus
    • Troubleshooting data ingestion

Products

  • Log management
    • Log Explorer
      • Use log correlation
      • Use live mode in Logs Explorer
      • Add new datasets to Log Explorer
    • Use log correlation
    • Use live mode in Logs Explorer
    • Add new datasets to Log Explorer
    • Unified Search syntax
      • Migrate to Unified Search syntax
  • Application Performance Monitoring
    • Service management
    • Troubleshoot slow databases / n+1 issues
    • Monitor and track new deploys on your service
    • Associate Infrastructure Metrics with Services
    • Trace Explorer
    • Monitor business applications
    • View logs associated with a trace
    • APM reference
  • LLM observability
    • LLM telemetry reference
  • Frontend observability
    • RUM telemetry reference
  • Metrics
    • Collect and use metrics
      • Add metrics using the Metrics Expression Builder
      • Tutorial: Shape host system metrics
      • Tutorial: Shaping metrics
      • Add custom metric Datasets
    • Tutorial: Shaping metrics
    • Metrics Explorer
    • Add custom metric Datasets
    • Add metrics using the Metrics Expression Builder
    • Tutorial: Shape host system metrics
    • Tutorial: Aggregated metrics shaping
  • Kubernetes observability
    • Install the Observe Agent
    • Kubernetes visibility
    • Kubernets Resource Utilization
    • Kubernetes data collection and agent interface
    • Metrics
    • Logs
  • Snowflake observability
    • Observe for Snowflake components
    • Prepare Observe to receive Snowflake data
    • Create virtual warehouse to run Observe for Snowflake
    • Install the Observe for Snowflake application
    • Configure the Observe for Snowflake application
    • Send data from Snowflake to Observe
    • Snowflake data in Observe
    • Manage Snowflake with Observe

Platform Capabilities

  • Create dashboards
    • Use dashboards to visualize data
    • Generate dashboard reports
  • Monitors and alerts
    • Create a threshold monitor
    • Create a count monitor
    • Create a promote monitor
    • Monitor rules and severities
    • Mute monitors
    • Customizing alert messages
      • Mustache template reference
    • Overview of shared actions
    • Alerting example: shared actions and monitors
    • Work with alerts in Observe
    • Tune and troubleshoot monitor health
    • Negative Monitoring
    • Monitor anti-patterns
    • Shared action integrations
      • Sample action for Microsoft Teams
      • Customization Options
      • PagerDuty
  • Create and share worksheets
    • Work with data formats and types
  • Pivot between data types
  • Correlation tags
  • Resources
  • Data export
  • Drop filters

Manage Observe

  • Authentication and Authorization in Observe
    • Audit trail
    • Role-based access control (RBAC)
    • Configure single sign-on (SSO)
      • Configure Microsoft Entra ID (formerly Azure Active Directory) single sign-on (SSO)
      • Configure Microsoft Active Directory Federation Service (ADFS)
      • Configure Google Workspace SAML and single sign-on (SSO)
      • Configure Okta for SAML and single sign-on (SSO)
      • Configure OneLogin for single sign-on (SSO)
      • Configure Ping Identity PingOne for single sign-on (SSO)
    • Observe API authentication
    • Observe API tokens
  • Manage application data volume
  • Customizing the Home page
    • Create and use favorites
  • Use Acceleration Manager with Datasets
  • Use Credit Manager to manage compute usage
    • Configuring Credit Manager settings via Terraform
    • View your ingest usage in the License Dashboard
    • View your compute credit usage in the Usage Dashboard
  • Observe Terraform provider
  • Observe regions
  • Settings

Develop with Observe

  • Export query results
  • Developer toolkit overview
  • URL query parameters
  • Observe command line interface (CLI) tool overview
    • login command
    • help command
    • get command
    • list command
    • query command
  • Snowflake outbound sharing

Reference

  • Key Observe concepts
    • Advanced Observe concepts
    • Explore data
    • About queries and on-demand acceleration
    • Observe Datasets and time
      • Foreign keys
      • Resource primary keys
      • Resource times
      • Reference tables
  • Visualization types
  • OPAL query language reference
    • OPAL — Observe Processing and Analysis Language
      • All OPAL functions
        • OPAL Functions By Category
          • OPAL Aggregate Functions
            • any
            • any_not_null
            • array_agg
            • array_agg_distinct
            • array_union_agg
            • avg
            • count
            • count_distinct
            • count_distinct_exact
            • delta
            • delta_monotonic
            • deriv
            • first
            • first_not_null
            • hash_agg
            • hash_agg_distinct
            • histogram_combine
            • last
            • last_not_null
            • max
            • median
            • median_exact
            • min
            • object_agg
            • otel_exponential_histogram_sum
            • otel_histogram_sum
            • percentile
            • percentile_cont
            • percentile_disc
            • prom_quantile
            • rate
            • stddev
            • string_agg
            • string_agg_distinct
            • sum
            • tdigest_agg
            • tdigest_combine
            • topk_agg
          • OPAL Boolean Functions
            • array_contains
            • arrays_overlap
            • bool
            • bool_null
            • contains
            • ends_with
            • eq
            • gt
            • gte
            • in
            • ipv4_address_in_network
            • is_null
            • like
            • lt
            • lte
            • match_regex
            • ne
            • path_exists
            • same
            • search
            • starts_with
          • OPAL Misc Functions
            • asc
            • coalesce
            • desc
            • exponential_histogram_null
            • float64
            • frame
            • frame_exact
            • frame_following
            • frame_preceding
            • hash
            • histogram_null
            • histogram_quantile
            • if
            • if_null
            • int64
            • m_exponential_histogram
            • m_histogram
            • m_tdigest
            • nullsfirst
            • nullslast
            • numeric_null
            • on
            • order_by
            • parse_hex
            • strlen
            • tdigest
            • tdigest_null
            • variant_null
          • OPAL Networking Functions
            • int64_to_ipv4
            • ipv4
            • ipv4_address_in_network
            • ipv4_network_int64
            • ipv4_to_int64
            • parse_ip
          • OPAL Numeric Functions
            • abs
            • arccos_deg
            • arccos_rad
            • arcsin_deg
            • arcsin_rad
            • arctan_deg
            • arctan_rad
            • avg
            • ceil
            • cos_deg
            • cos_rad
            • count
            • degrees
            • delta
            • delta_monotonic
            • dense_rank
            • deriv
            • ewma
            • exp
            • float64_null
            • floor
            • haversine_distance_km
            • int64_null
            • int_div
            • ln
            • log
            • median
            • median_exact
            • mod
            • percentile
            • percentile_cont
            • percentile_disc
            • pi
            • pow
            • prom_quantile
            • radians
            • rank
            • rate
            • round
            • row_number
            • sin_deg
            • sin_rad
            • sqrt
            • stddev
            • sum
            • tan_deg
            • tan_rad
            • uniform
            • width_bucket
            • zipf
          • OPAL Regex Functions
            • count_regex_matches
            • get_regex
            • get_regex_all
            • match_regex
            • regex
            • replace_regex
          • OPAL Semistructured Functions
            • append_item
            • array
            • array_agg
            • array_agg_distinct
            • array_contains
            • array_distinct
            • array_length
            • array_max
            • array_min
            • array_null
            • array_to_string
            • array_union_agg
            • arrays_overlap
            • concat_arrays
            • detect_browser
            • drop_fields
            • embed_sql_params
            • get_field
            • get_item
            • get_jmespath
            • get_regex_all
            • index_of_item
            • insert_item
            • intersect_arrays
            • m_object
            • make_array
            • make_array_range
            • make_fields
            • make_object
            • merge_objects
            • object
            • object_agg
            • object_keys
            • object_null
            • otel_exponential_histogram_quantile
            • otel_exponential_histogram_sum
            • otel_histogram_quantile
            • otel_histogram_sum
            • parse_csv
            • parse_ip
            • parse_json
            • parse_kvs
            • parse_url
            • path_exists
            • pick_fields
            • pivot_array
            • prepend_item
            • slice_array
            • sort_array
            • split
            • tokenize
            • topk_agg
            • unpivot_array
          • OPAL Special Functions
            • case
            • group_by
            • m
            • metric
            • options
            • primary_key
            • pk
            • tags
            • valid_for
            • window
          • OPAL String Functions
            • array_to_string
            • check_json
            • concat_strings
            • contains
            • decode_base64
            • decode_uri
            • decode_uri_component
            • detect_browser
            • editdistance
            • embed_sql_params
            • encode_base64
            • encode_uri
            • encode_uri_component
            • ends_with
            • format_time
            • get_regex
            • int64_to_ipv4
            • ipv4_address_in_network
            • label
            • left
            • like
            • lower
            • lpad
            • ltrim
            • parse_csv
            • parse_kvs
            • parse_timestamp
            • pivot_array
            • position
            • regex
            • replace
            • replace_regex
            • right
            • rpad
            • rtrim
            • sha2
            • split
            • split_part
            • starts_with
            • string
            • string_agg
            • string_agg_distinct
            • string_null
            • substring
            • tokenize
            • tokenize_part
            • trim
            • unpivot_array
            • upper
            • variant_type_name
          • OPAL Time Functions
            • abs
            • avg
            • bin_end_time
            • bin_size
            • bin_start_time
            • delta
            • delta_monotonic
            • deriv
            • duration
            • duration_hr
            • duration_min
            • duration_ms
            • duration_null
            • duration_sec
            • ewma
            • format_time
            • from_milliseconds
            • timestamp_ms
            • from_nanoseconds
            • timestamp_ns
            • from_seconds
            • timestamp_s
            • histogram_fraction
            • median
            • median_exact
            • now
            • parse_duration
            • parse_isotime
            • parse_timestamp
            • percentile
            • percentile_cont
            • percentile_disc
            • query_end_time
            • query_start_time
            • rate
            • row_end_time
            • row_timestamp
            • row_start_time
            • stddev
            • sum
            • tdigest_agg
            • tdigest_quantile
            • timestamp_null
            • to_days
            • to_hours
            • to_milliseconds
            • to_minutes
            • to_nanoseconds
            • to_seconds
            • to_weeks
            • valid_for
          • OPAL Window Functions
            • any
            • any_not_null
            • array_union_agg
            • avg
            • count
            • count_distinct
            • count_distinct_exact
            • delta
            • delta_monotonic
            • dense_rank
            • deriv
            • ewma
            • first
            • first_not_null
            • hash_agg
            • hash_agg_distinct
            • lag
            • lag_not_null
            • last
            • last_not_null
            • lead
            • lead_not_null
            • max
            • median
            • median_exact
            • min
            • object_agg
            • percentile
            • percentile_cont
            • percentile_disc
            • rank
            • rate
            • row_number
            • stddev
            • sum
            • tdigest_agg
            • tdigest_combine
            • topk_agg
          • OPAL Deprecated Function Aliases
            • any_null
            • array_pivot
            • array_unpivot
            • countdistinct
            • countdistinctexact
            • decodebase64
            • denserank
            • encodebase64
            • endswith
            • groupby
            • ifnull
            • isnull
            • makeobject
            • match_regex_all
            • medianexact
            • milliseconds
            • nanoseconds
            • orderby
            • parsehex
            • parseip
            • parseisotime
            • parsejson
            • parsekvs
            • parseurl
            • percentilecont
            • percentiledisc
            • primarykey
            • queryendtime
            • querystarttime
            • regex_match
            • regex_replace
            • row_endtime
            • rownumber
            • seconds
            • startswith
            • strcat
            • string_concat
            • validfor
      • All OPAL verbs
        • OPAL Verbs By Category
          • OPAL Aggregate Verbs
            • aggregate
            • align
            • dedup
            • distinct
            • fill
            • histogram
            • make_session
            • merge_events
            • pivot
            • rollup
            • statsby
            • timechart
            • bucketize
            • timestats
            • unpivot
          • OPAL Filter Verbs
            • always
            • bottomk
            • ever
            • filter
            • filter_last
            • limit
            • never
            • topk
          • OPAL Join Verbs
            • exists
            • follow
            • follow_not
            • fulljoin
            • join
            • leftjoin
            • lookup
            • lookup_ip_info
            • not_exists
            • surrounding
            • union
            • update_resource
          • OPAL Metadata Verbs
            • add_key
            • drop_interface
            • interface
            • make_event
            • make_interval
            • make_metric
            • make_resource
            • make_session
            • make_table
            • merge_events
            • set_col_enum
            • set_col_immutable
            • set_col_searchable
            • set_col_visible
            • set_label
            • set_link
            • set_metric
            • set_metric_metadata
            • set_primary_key
            • set_pk
            • set_timestamp
            • set_valid_from
            • set_valid_to
            • sort
            • timeshift
            • unset_all_links
            • unset_keys
            • unset_link
            • unsort
          • OPAL Metrics Verbs
            • aggregate
            • align
            • make_metric
            • rollup
            • set_metric
            • timeshift
          • OPAL Projection Verbs
            • drop_col
            • extract_regex
            • make_col
            • pick_col
            • rename_col
          • OPAL Semistructured Verbs
            • extract_regex
            • flatten
            • flatten_all
            • flatten_leaves
            • flatten_single
          • OPAL Deprecated Verb Aliases
            • addfk
            • addkey
            • addmetric
            • changelog
            • coldrop
            • colenum
            • colimmutable
            • colmake
            • colpick
            • colregex
            • colrename
            • colshow
            • droptime
            • fkdrop
            • flattenall
            • flattenleaves
            • flattensingle
            • makeresource
            • makesession
            • merge_event
            • mergeevent
            • reaggregate
            • setlabel
            • setpk
            • setvf
            • setvt
      • Language syntax
      • Data Types and Operators
    • Language syntax
    • Data Types and Operators
    • Performance cookbook
      • Observe Performance Cookbook: Use Approximate Values When Feasible
      • Observe Performance Cookbook: Avoid Large JSON Blobs
      • Observe Performance Cookbook: Cast Data Columns Extracted from JSON
      • Observe Performance Cookbook: Create Intermediate Datasets
      • Observe Performance Cookbook: Filter Earlier in OPAL Scripts
      • Observe Performance Cookbook: Using Filter instead of Ever
      • Observe Performance Cookbook: Flatten Less First
      • Observe Performance Cookbook: Limit Worksheet Time Windows
      • Observe Performance Cookbook: Limit Resource Time Windows
      • Observe Performance Cookbook: Limit Valid Event Time Windows
      • Observe Performance Cookbook: Look for Hidden Columns
      • Observe Performance Cookbook: Use Make_Events before Window Functions
      • Observe Performance Cookbook: Mark Immutable Resource Columns
      • Observe Performance Cookbook: Making Resources from Multiple Datasets
      • Observe Performance Cookbook: Prefer Join to Lookup
      • Observe Performance Cookbook: Prefer Lead and Lag to First and Last
      • Observe Performance Cookbook: Prefer Timechart to Timestats
      • Observe Performance Cookbook: Limit Query Time Windows
      • Observe Performance Cookbook: Limit Query Time Windows
      • Observe Performance Cookbook: Reduce Columns Earlier in OPAL Scripts
      • Observe Performance Cookbook: Extract from JSON instead of using Flatten
      • Observe Performance Cookbook: Type Data Columns
      • Observe Performance Cookbook: Use Interval for Ephemeral Things
    • Examples
    • All OPAL functions
      • OPAL Functions By Category
        • OPAL Aggregate Functions
          • any
          • any_not_null
          • array_agg
          • array_agg_distinct
          • array_union_agg
          • avg
          • count
          • count_distinct
          • count_distinct_exact
          • delta
          • delta_monotonic
          • deriv
          • first
          • first_not_null
          • hash_agg
          • hash_agg_distinct
          • histogram_combine
          • last
          • last_not_null
          • max
          • median
          • median_exact
          • min
          • object_agg
          • otel_exponential_histogram_sum
          • otel_histogram_sum
          • percentile
          • percentile_cont
          • percentile_disc
          • prom_quantile
          • rate
          • stddev
          • string_agg
          • string_agg_distinct
          • sum
          • tdigest_agg
          • tdigest_combine
          • topk_agg
        • OPAL Boolean Functions
          • array_contains
          • arrays_overlap
          • bool
          • bool_null
          • contains
          • ends_with
          • eq
          • gt
          • gte
          • in
          • ipv4_address_in_network
          • is_null
          • like
          • lt
          • lte
          • match_regex
          • ne
          • path_exists
          • same
          • search
          • starts_with
        • OPAL Misc Functions
          • asc
          • coalesce
          • desc
          • exponential_histogram_null
          • float64
          • frame
          • frame_exact
          • frame_following
          • frame_preceding
          • hash
          • histogram_null
          • histogram_quantile
          • if
          • if_null
          • int64
          • m_exponential_histogram
          • m_histogram
          • m_tdigest
          • nullsfirst
          • nullslast
          • numeric_null
          • on
          • order_by
          • parse_hex
          • strlen
          • tdigest
          • tdigest_null
          • variant_null
        • OPAL Networking Functions
          • int64_to_ipv4
          • ipv4
          • ipv4_address_in_network
          • ipv4_network_int64
          • ipv4_to_int64
          • parse_ip
        • OPAL Numeric Functions
          • abs
          • arccos_deg
          • arccos_rad
          • arcsin_deg
          • arcsin_rad
          • arctan_deg
          • arctan_rad
          • avg
          • ceil
          • cos_deg
          • cos_rad
          • count
          • degrees
          • delta
          • delta_monotonic
          • dense_rank
          • deriv
          • ewma
          • exp
          • float64_null
          • floor
          • haversine_distance_km
          • int64_null
          • int_div
          • ln
          • log
          • median
          • median_exact
          • mod
          • percentile
          • percentile_cont
          • percentile_disc
          • pi
          • pow
          • prom_quantile
          • radians
          • rank
          • rate
          • round
          • row_number
          • sin_deg
          • sin_rad
          • sqrt
          • stddev
          • sum
          • tan_deg
          • tan_rad
          • uniform
          • width_bucket
          • zipf
        • OPAL Regex Functions
          • count_regex_matches
          • get_regex
          • get_regex_all
          • match_regex
          • regex
          • replace_regex
        • OPAL Semistructured Functions
          • append_item
          • array
          • array_agg
          • array_agg_distinct
          • array_contains
          • array_distinct
          • array_length
          • array_max
          • array_min
          • array_null
          • array_to_string
          • array_union_agg
          • arrays_overlap
          • concat_arrays
          • detect_browser
          • drop_fields
          • embed_sql_params
          • get_field
          • get_item
          • get_jmespath
          • get_regex_all
          • index_of_item
          • insert_item
          • intersect_arrays
          • m_object
          • make_array
          • make_array_range
          • make_fields
          • make_object
          • merge_objects
          • object
          • object_agg
          • object_keys
          • object_null
          • otel_exponential_histogram_quantile
          • otel_exponential_histogram_sum
          • otel_histogram_quantile
          • otel_histogram_sum
          • parse_csv
          • parse_ip
          • parse_json
          • parse_kvs
          • parse_url
          • path_exists
          • pick_fields
          • pivot_array
          • prepend_item
          • slice_array
          • sort_array
          • split
          • tokenize
          • topk_agg
          • unpivot_array
        • OPAL Special Functions
          • case
          • group_by
          • m
          • metric
          • options
          • primary_key
          • pk
          • tags
          • valid_for
          • window
        • OPAL String Functions
          • array_to_string
          • check_json
          • concat_strings
          • contains
          • decode_base64
          • decode_uri
          • decode_uri_component
          • detect_browser
          • editdistance
          • embed_sql_params
          • encode_base64
          • encode_uri
          • encode_uri_component
          • ends_with
          • format_time
          • get_regex
          • int64_to_ipv4
          • ipv4_address_in_network
          • label
          • left
          • like
          • lower
          • lpad
          • ltrim
          • parse_csv
          • parse_kvs
          • parse_timestamp
          • pivot_array
          • position
          • regex
          • replace
          • replace_regex
          • right
          • rpad
          • rtrim
          • sha2
          • split
          • split_part
          • starts_with
          • string
          • string_agg
          • string_agg_distinct
          • string_null
          • substring
          • tokenize
          • tokenize_part
          • trim
          • unpivot_array
          • upper
          • variant_type_name
        • OPAL Time Functions
          • abs
          • avg
          • bin_end_time
          • bin_size
          • bin_start_time
          • delta
          • delta_monotonic
          • deriv
          • duration
          • duration_hr
          • duration_min
          • duration_ms
          • duration_null
          • duration_sec
          • ewma
          • format_time
          • from_milliseconds
          • timestamp_ms
          • from_nanoseconds
          • timestamp_ns
          • from_seconds
          • timestamp_s
          • histogram_fraction
          • median
          • median_exact
          • now
          • parse_duration
          • parse_isotime
          • parse_timestamp
          • percentile
          • percentile_cont
          • percentile_disc
          • query_end_time
          • query_start_time
          • rate
          • row_end_time
          • row_timestamp
          • row_start_time
          • stddev
          • sum
          • tdigest_agg
          • tdigest_quantile
          • timestamp_null
          • to_days
          • to_hours
          • to_milliseconds
          • to_minutes
          • to_nanoseconds
          • to_seconds
          • to_weeks
          • valid_for
        • OPAL Window Functions
          • any
          • any_not_null
          • array_union_agg
          • avg
          • count
          • count_distinct
          • count_distinct_exact
          • delta
          • delta_monotonic
          • dense_rank
          • deriv
          • ewma
          • first
          • first_not_null
          • hash_agg
          • hash_agg_distinct
          • lag
          • lag_not_null
          • last
          • last_not_null
          • lead
          • lead_not_null
          • max
          • median
          • median_exact
          • min
          • object_agg
          • percentile
          • percentile_cont
          • percentile_disc
          • rank
          • rate
          • row_number
          • stddev
          • sum
          • tdigest_agg
          • tdigest_combine
          • topk_agg
        • OPAL Deprecated Function Aliases
          • any_null
          • array_pivot
          • array_unpivot
          • countdistinct
          • countdistinctexact
          • decodebase64
          • denserank
          • encodebase64
          • endswith
          • groupby
          • ifnull
          • isnull
          • makeobject
          • match_regex_all
          • medianexact
          • milliseconds
          • nanoseconds
          • orderby
          • parsehex
          • parseip
          • parseisotime
          • parsejson
          • parsekvs
          • parseurl
          • percentilecont
          • percentiledisc
          • primarykey
          • queryendtime
          • querystarttime
          • regex_match
          • regex_replace
          • row_endtime
          • rownumber
          • seconds
          • startswith
          • strcat
          • string_concat
          • validfor
    • OPAL Functions By Category
      • OPAL Aggregate Functions
        • any
        • any_not_null
        • array_agg
        • array_agg_distinct
        • array_union_agg
        • avg
        • count
        • count_distinct
        • count_distinct_exact
        • delta
        • delta_monotonic
        • deriv
        • first
        • first_not_null
        • hash_agg
        • hash_agg_distinct
        • histogram_combine
        • last
        • last_not_null
        • max
        • median
        • median_exact
        • min
        • object_agg
        • otel_exponential_histogram_sum
        • otel_histogram_sum
        • percentile
        • percentile_cont
        • percentile_disc
        • prom_quantile
        • rate
        • stddev
        • string_agg
        • string_agg_distinct
        • sum
        • tdigest_agg
        • tdigest_combine
        • topk_agg
      • OPAL Boolean Functions
        • array_contains
        • arrays_overlap
        • bool
        • bool_null
        • contains
        • ends_with
        • eq
        • gt
        • gte
        • in
        • ipv4_address_in_network
        • is_null
        • like
        • lt
        • lte
        • match_regex
        • ne
        • path_exists
        • same
        • search
        • starts_with
      • OPAL Misc Functions
        • asc
        • coalesce
        • desc
        • exponential_histogram_null
        • float64
        • frame
        • frame_exact
        • frame_following
        • frame_preceding
        • hash
        • histogram_null
        • histogram_quantile
        • if
        • if_null
        • int64
        • m_exponential_histogram
        • m_histogram
        • m_tdigest
        • nullsfirst
        • nullslast
        • numeric_null
        • on
        • order_by
        • parse_hex
        • strlen
        • tdigest
        • tdigest_null
        • variant_null
      • OPAL Networking Functions
        • int64_to_ipv4
        • ipv4
        • ipv4_address_in_network
        • ipv4_network_int64
        • ipv4_to_int64
        • parse_ip
      • OPAL Numeric Functions
        • abs
        • arccos_deg
        • arccos_rad
        • arcsin_deg
        • arcsin_rad
        • arctan_deg
        • arctan_rad
        • avg
        • ceil
        • cos_deg
        • cos_rad
        • count
        • degrees
        • delta
        • delta_monotonic
        • dense_rank
        • deriv
        • ewma
        • exp
        • float64_null
        • floor
        • haversine_distance_km
        • int64_null
        • int_div
        • ln
        • log
        • median
        • median_exact
        • mod
        • percentile
        • percentile_cont
        • percentile_disc
        • pi
        • pow
        • prom_quantile
        • radians
        • rank
        • rate
        • round
        • row_number
        • sin_deg
        • sin_rad
        • sqrt
        • stddev
        • sum
        • tan_deg
        • tan_rad
        • uniform
        • width_bucket
        • zipf
      • OPAL Regex Functions
        • count_regex_matches
        • get_regex
        • get_regex_all
        • match_regex
        • regex
        • replace_regex
      • OPAL Semistructured Functions
        • append_item
        • array
        • array_agg
        • array_agg_distinct
        • array_contains
        • array_distinct
        • array_length
        • array_max
        • array_min
        • array_null
        • array_to_string
        • array_union_agg
        • arrays_overlap
        • concat_arrays
        • detect_browser
        • drop_fields
        • embed_sql_params
        • get_field
        • get_item
        • get_jmespath
        • get_regex_all
        • index_of_item
        • insert_item
        • intersect_arrays
        • m_object
        • make_array
        • make_array_range
        • make_fields
        • make_object
        • merge_objects
        • object
        • object_agg
        • object_keys
        • object_null
        • otel_exponential_histogram_quantile
        • otel_exponential_histogram_sum
        • otel_histogram_quantile
        • otel_histogram_sum
        • parse_csv
        • parse_ip
        • parse_json
        • parse_kvs
        • parse_url
        • path_exists
        • pick_fields
        • pivot_array
        • prepend_item
        • slice_array
        • sort_array
        • split
        • tokenize
        • topk_agg
        • unpivot_array
      • OPAL Special Functions
        • case
        • group_by
        • m
        • metric
        • options
        • primary_key
        • pk
        • tags
        • valid_for
        • window
      • OPAL String Functions
        • array_to_string
        • check_json
        • concat_strings
        • contains
        • decode_base64
        • decode_uri
        • decode_uri_component
        • detect_browser
        • editdistance
        • embed_sql_params
        • encode_base64
        • encode_uri
        • encode_uri_component
        • ends_with
        • format_time
        • get_regex
        • int64_to_ipv4
        • ipv4_address_in_network
        • label
        • left
        • like
        • lower
        • lpad
        • ltrim
        • parse_csv
        • parse_kvs
        • parse_timestamp
        • pivot_array
        • position
        • regex
        • replace
        • replace_regex
        • right
        • rpad
        • rtrim
        • sha2
        • split
        • split_part
        • starts_with
        • string
        • string_agg
        • string_agg_distinct
        • string_null
        • substring
        • tokenize
        • tokenize_part
        • trim
        • unpivot_array
        • upper
        • variant_type_name
      • OPAL Time Functions
        • abs
        • avg
        • bin_end_time
        • bin_size
        • bin_start_time
        • delta
        • delta_monotonic
        • deriv
        • duration
        • duration_hr
        • duration_min
        • duration_ms
        • duration_null
        • duration_sec
        • ewma
        • format_time
        • from_milliseconds
        • timestamp_ms
        • from_nanoseconds
        • timestamp_ns
        • from_seconds
        • timestamp_s
        • histogram_fraction
        • median
        • median_exact
        • now
        • parse_duration
        • parse_isotime
        • parse_timestamp
        • percentile
        • percentile_cont
        • percentile_disc
        • query_end_time
        • query_start_time
        • rate
        • row_end_time
        • row_timestamp
        • row_start_time
        • stddev
        • sum
        • tdigest_agg
        • tdigest_quantile
        • timestamp_null
        • to_days
        • to_hours
        • to_milliseconds
        • to_minutes
        • to_nanoseconds
        • to_seconds
        • to_weeks
        • valid_for
      • OPAL Window Functions
        • any
        • any_not_null
        • array_union_agg
        • avg
        • count
        • count_distinct
        • count_distinct_exact
        • delta
        • delta_monotonic
        • dense_rank
        • deriv
        • ewma
        • first
        • first_not_null
        • hash_agg
        • hash_agg_distinct
        • lag
        • lag_not_null
        • last
        • last_not_null
        • lead
        • lead_not_null
        • max
        • median
        • median_exact
        • min
        • object_agg
        • percentile
        • percentile_cont
        • percentile_disc
        • rank
        • rate
        • row_number
        • stddev
        • sum
        • tdigest_agg
        • tdigest_combine
        • topk_agg
      • OPAL Deprecated Function Aliases
        • any_null
        • array_pivot
        • array_unpivot
        • countdistinct
        • countdistinctexact
        • decodebase64
        • denserank
        • encodebase64
        • endswith
        • groupby
        • ifnull
        • isnull
        • makeobject
        • match_regex_all
        • medianexact
        • milliseconds
        • nanoseconds
        • orderby
        • parsehex
        • parseip
        • parseisotime
        • parsejson
        • parsekvs
        • parseurl
        • percentilecont
        • percentiledisc
        • primarykey
        • queryendtime
        • querystarttime
        • regex_match
        • regex_replace
        • row_endtime
        • rownumber
        • seconds
        • startswith
        • strcat
        • string_concat
        • validfor
    • OPAL Aggregate Functions
      • any
      • any_not_null
      • array_agg
      • array_agg_distinct
      • array_union_agg
      • avg
      • count
      • count_distinct
      • count_distinct_exact
      • delta
      • delta_monotonic
      • deriv
      • first
      • first_not_null
      • hash_agg
      • hash_agg_distinct
      • histogram_combine
      • last
      • last_not_null
      • max
      • median
      • median_exact
      • min
      • object_agg
      • otel_exponential_histogram_sum
      • otel_histogram_sum
      • percentile
      • percentile_cont
      • percentile_disc
      • prom_quantile
      • rate
      • stddev
      • string_agg
      • string_agg_distinct
      • sum
      • tdigest_agg
      • tdigest_combine
      • topk_agg
    • OPAL Alignment Functions
      • any
      • any_not_null
      • avg
      • count
      • count_distinct
      • count_distinct_exact
      • delta
      • delta_monotonic
      • deriv
      • first
      • first_not_null
      • last
      • last_not_null
      • max
      • median
      • median_exact
      • min
      • object_agg
      • percentile
      • percentile_cont
      • percentile_disc
      • prom_quantile
      • rate
      • stddev
      • sum
      • tdigest_agg
      • tdigest_combine
      • topk_agg
    • OPAL Boolean Functions
      • array_contains
      • arrays_overlap
      • bool
      • bool_null
      • contains
      • ends_with
      • eq
      • gt
      • gte
      • in
      • ipv4_address_in_network
      • is_null
      • like
      • lt
      • lte
      • match_regex
      • ne
      • path_exists
      • same
      • search
      • starts_with
    • OPAL Case Sensitivity
    • OPAL Numeric Functions
      • abs
      • arccos_deg
      • arccos_rad
      • arcsin_deg
      • arcsin_rad
      • arctan_deg
      • arctan_rad
      • avg
      • ceil
      • cos_deg
      • cos_rad
      • count
      • degrees
      • delta
      • delta_monotonic
      • dense_rank
      • deriv
      • ewma
      • exp
      • float64_null
      • floor
      • haversine_distance_km
      • int64_null
      • int_div
      • ln
      • log
      • median
      • median_exact
      • mod
      • percentile
      • percentile_cont
      • percentile_disc
      • pi
      • pow
      • prom_quantile
      • radians
      • rank
      • rate
      • round
      • row_number
      • sin_deg
      • sin_rad
      • sqrt
      • stddev
      • sum
      • tan_deg
      • tan_rad
      • uniform
      • width_bucket
      • zipf
    • OPAL Regex Functions
      • count_regex_matches
      • get_regex
      • get_regex_all
      • match_regex
      • regex
      • replace_regex
    • OPAL Semistructured Functions
      • append_item
      • array
      • array_agg
      • array_agg_distinct
      • array_contains
      • array_distinct
      • array_length
      • array_max
      • array_min
      • array_null
      • array_to_string
      • array_union_agg
      • arrays_overlap
      • concat_arrays
      • detect_browser
      • drop_fields
      • embed_sql_params
      • get_field
      • get_item
      • get_jmespath
      • get_regex_all
      • index_of_item
      • insert_item
      • intersect_arrays
      • m_object
      • make_array
      • make_array_range
      • make_fields
      • make_object
      • merge_objects
      • object
      • object_agg
      • object_keys
      • object_null
      • otel_exponential_histogram_quantile
      • otel_exponential_histogram_sum
      • otel_histogram_quantile
      • otel_histogram_sum
      • parse_csv
      • parse_ip
      • parse_json
      • parse_kvs
      • parse_url
      • path_exists
      • pick_fields
      • pivot_array
      • prepend_item
      • slice_array
      • sort_array
      • split
      • tokenize
      • topk_agg
      • unpivot_array
    • OPAL Special Functions
      • case
      • group_by
      • m
      • metric
      • options
      • primary_key
      • pk
      • tags
      • valid_for
      • window
    • OPAL Time Functions
      • abs
      • avg
      • bin_end_time
      • bin_size
      • bin_start_time
      • delta
      • delta_monotonic
      • deriv
      • duration
      • duration_hr
      • duration_min
      • duration_ms
      • duration_null
      • duration_sec
      • ewma
      • format_time
      • from_milliseconds
      • timestamp_ms
      • from_nanoseconds
      • timestamp_ns
      • from_seconds
      • timestamp_s
      • histogram_fraction
      • median
      • median_exact
      • now
      • parse_duration
      • parse_isotime
      • parse_timestamp
      • percentile
      • percentile_cont
      • percentile_disc
      • query_end_time
      • query_start_time
      • rate
      • row_end_time
      • row_timestamp
      • row_start_time
      • stddev
      • sum
      • tdigest_agg
      • tdigest_quantile
      • timestamp_null
      • to_days
      • to_hours
      • to_milliseconds
      • to_minutes
      • to_nanoseconds
      • to_seconds
      • to_weeks
      • valid_for
    • Parsing Time Strings in OPAL
    • OPAL Networking Functions
      • int64_to_ipv4
      • ipv4
      • ipv4_address_in_network
      • ipv4_network_int64
      • ipv4_to_int64
      • parse_ip
    • OPAL Window Functions
      • any
      • any_not_null
      • array_union_agg
      • avg
      • count
      • count_distinct
      • count_distinct_exact
      • delta
      • delta_monotonic
      • dense_rank
      • deriv
      • ewma
      • first
      • first_not_null
      • hash_agg
      • hash_agg_distinct
      • lag
      • lag_not_null
      • last
      • last_not_null
      • lead
      • lead_not_null
      • max
      • median
      • median_exact
      • min
      • object_agg
      • percentile
      • percentile_cont
      • percentile_disc
      • rank
      • rate
      • row_number
      • stddev
      • sum
      • tdigest_agg
      • tdigest_combine
      • topk_agg
    • OPAL Misc Functions
      • asc
      • coalesce
      • desc
      • exponential_histogram_null
      • float64
      • frame
      • frame_exact
      • frame_following
      • frame_preceding
      • hash
      • histogram_null
      • histogram_quantile
      • if
      • if_null
      • int64
      • m_exponential_histogram
      • m_histogram
      • m_tdigest
      • nullsfirst
      • nullslast
      • numeric_null
      • on
      • order_by
      • parse_hex
      • strlen
      • tdigest
      • tdigest_null
      • variant_null
    • OPAL Deprecated Function Aliases
      • any_null
      • array_pivot
      • array_unpivot
      • countdistinct
      • countdistinctexact
      • decodebase64
      • denserank
      • encodebase64
      • endswith
      • groupby
      • ifnull
      • isnull
      • makeobject
      • match_regex_all
      • medianexact
      • milliseconds
      • nanoseconds
      • orderby
      • parsehex
      • parseip
      • parseisotime
      • parsejson
      • parsekvs
      • parseurl
      • percentilecont
      • percentiledisc
      • primarykey
      • queryendtime
      • querystarttime
      • regex_match
      • regex_replace
      • row_endtime
      • rownumber
      • seconds
      • startswith
      • strcat
      • string_concat
      • validfor
    • All OPAL verbs
      • OPAL Verbs By Category
        • OPAL Aggregate Verbs
          • aggregate
          • align
          • dedup
          • distinct
          • fill
          • histogram
          • make_session
          • merge_events
          • pivot
          • rollup
          • statsby
          • timechart
          • bucketize
          • timestats
          • unpivot
        • OPAL Filter Verbs
          • always
          • bottomk
          • ever
          • filter
          • filter_last
          • limit
          • never
          • topk
        • OPAL Join Verbs
          • exists
          • follow
          • follow_not
          • fulljoin
          • join
          • leftjoin
          • lookup
          • lookup_ip_info
          • not_exists
          • surrounding
          • union
          • update_resource
        • OPAL Metadata Verbs
          • add_key
          • drop_interface
          • interface
          • make_event
          • make_interval
          • make_metric
          • make_resource
          • make_session
          • make_table
          • merge_events
          • set_col_enum
          • set_col_immutable
          • set_col_searchable
          • set_col_visible
          • set_label
          • set_link
          • set_metric
          • set_metric_metadata
          • set_primary_key
          • set_pk
          • set_timestamp
          • set_valid_from
          • set_valid_to
          • sort
          • timeshift
          • unset_all_links
          • unset_keys
          • unset_link
          • unsort
        • OPAL Metrics Verbs
          • aggregate
          • align
          • make_metric
          • rollup
          • set_metric
          • timeshift
        • OPAL Projection Verbs
          • drop_col
          • extract_regex
          • make_col
          • pick_col
          • rename_col
        • OPAL Semistructured Verbs
          • extract_regex
          • flatten
          • flatten_all
          • flatten_leaves
          • flatten_single
        • OPAL Deprecated Verb Aliases
          • addfk
          • addkey
          • addmetric
          • changelog
          • coldrop
          • colenum
          • colimmutable
          • colmake
          • colpick
          • colregex
          • colrename
          • colshow
          • droptime
          • fkdrop
          • flattenall
          • flattenleaves
          • flattensingle
          • makeresource
          • makesession
          • merge_event
          • mergeevent
          • reaggregate
          • setlabel
          • setpk
          • setvf
          • setvt
    • OPAL Verbs By Category
      • OPAL Aggregate Verbs
        • aggregate
        • align
        • dedup
        • distinct
        • fill
        • histogram
        • make_session
        • merge_events
        • pivot
        • rollup
        • statsby
        • timechart
        • bucketize
        • timestats
        • unpivot
      • OPAL Filter Verbs
        • always
        • bottomk
        • ever
        • filter
        • filter_last
        • limit
        • never
        • topk
      • OPAL Join Verbs
        • exists
        • follow
        • follow_not
        • fulljoin
        • join
        • leftjoin
        • lookup
        • lookup_ip_info
        • not_exists
        • surrounding
        • union
        • update_resource
      • OPAL Metadata Verbs
        • add_key
        • drop_interface
        • interface
        • make_event
        • make_interval
        • make_metric
        • make_resource
        • make_session
        • make_table
        • merge_events
        • set_col_enum
        • set_col_immutable
        • set_col_searchable
        • set_col_visible
        • set_label
        • set_link
        • set_metric
        • set_metric_metadata
        • set_primary_key
        • set_pk
        • set_timestamp
        • set_valid_from
        • set_valid_to
        • sort
        • timeshift
        • unset_all_links
        • unset_keys
        • unset_link
        • unsort
      • OPAL Metrics Verbs
        • aggregate
        • align
        • make_metric
        • rollup
        • set_metric
        • timeshift
      • OPAL Projection Verbs
        • drop_col
        • extract_regex
        • make_col
        • pick_col
        • rename_col
      • OPAL Semistructured Verbs
        • extract_regex
        • flatten
        • flatten_all
        • flatten_leaves
        • flatten_single
      • OPAL Deprecated Verb Aliases
        • addfk
        • addkey
        • addmetric
        • changelog
        • coldrop
        • colenum
        • colimmutable
        • colmake
        • colpick
        • colregex
        • colrename
        • colshow
        • droptime
        • fkdrop
        • flattenall
        • flattenleaves
        • flattensingle
        • makeresource
        • makesession
        • merge_event
        • mergeevent
        • reaggregate
        • setlabel
        • setpk
        • setvf
        • setvt
    • OPAL Aggregate Verbs
      • aggregate
      • align
      • dedup
      • distinct
      • fill
      • histogram
      • make_session
      • merge_events
      • pivot
      • rollup
      • statsby
      • timechart
      • bucketize
      • timestats
      • unpivot
    • OPAL Filter Verbs
      • always
      • bottomk
      • ever
      • filter
      • filter_last
      • limit
      • never
      • topk
    • OPAL Join Verbs
      • exists
      • follow
      • follow_not
      • fulljoin
      • join
      • leftjoin
      • lookup
      • lookup_ip_info
      • not_exists
      • surrounding
      • union
      • update_resource
    • OPAL Metrics Verbs
      • aggregate
      • align
      • make_metric
      • rollup
      • set_metric
      • timeshift
    • OPAL Projection Verbs
      • drop_col
      • extract_regex
      • make_col
      • pick_col
      • rename_col
    • OPAL Semistructured Verbs
      • extract_regex
      • flatten
      • flatten_all
      • flatten_leaves
      • flatten_single
    • OPAL Metadata Verbs
      • add_key
      • drop_interface
      • interface
      • make_event
      • make_interval
      • make_metric
      • make_resource
      • make_session
      • make_table
      • merge_events
      • set_col_enum
      • set_col_immutable
      • set_col_searchable
      • set_col_visible
      • set_label
      • set_link
      • set_metric
      • set_metric_metadata
      • set_primary_key
      • set_pk
      • set_timestamp
      • set_valid_from
      • set_valid_to
      • sort
      • timeshift
      • unset_all_links
      • unset_keys
      • unset_link
      • unsort
    • OPAL Deprecated Verb Aliases
      • addfk
      • addkey
      • addmetric
      • changelog
      • coldrop
      • colenum
      • colimmutable
      • colmake
      • colpick
      • colregex
      • colrename
      • colshow
      • droptime
      • fkdrop
      • flattenall
      • flattenleaves
      • flattensingle
      • makeresource
      • makesession
      • merge_event
      • mergeevent
      • reaggregate
      • setlabel
      • setpk
      • setvf
      • setvt
  • Observasaurus
    • Observasaurus: Accelerate
    • Observasaurus: Agents
    • Observasaurus: Channel
    • Observasaurus: Channel Action
    • Observasaurus: Collectors
    • Observasaurus: Console
    • Observasaurus: Dashboards
    • Observasaurus: Dataset Graph
    • Observasaurus: Datasets
    • Observasaurus: Datastreams
    • Observasaurus: Distributed Tracing
    • Observasaurus: Endpoints
    • Observasaurus: Explorers
    • Observasaurus: Freshness
    • Observasaurus: Link
    • Observasaurus: Logs
    • Observasaurus: Log Analytics
    • Observasaurus: Machine Data
    • Observasaurus: Metrics
    • Observasaurus: Metrics Analytics
    • Observasaurus: Metrics Tags
    • Observasaurus: Monitoring
    • Observasaurus: Monitors
    • Observasaurus: Observability
    • Observasaurus: OPAL
    • Observasaurus: Pollers
    • Observasaurus: Queries
    • Observasaurus: Resources
    • Observasaurus: Security Observability
    • Observasaurus: SIEM
    • Observasaurus: Spans
    • Observasaurus: Stages
    • Observasaurus: Streamable
    • Observasaurus: Telemetry
    • Observasaurus: Temporal SQL
    • Observasaurus: Time Series
    • Observasaurus: Tokens
    • Observasaurus: Traces
    • Observasaurus: Unstreamable
    • Observasaurus: Worksheets
  • Performance cookbook
    • Observe Performance Cookbook: Use Approximate Values When Feasible
    • Observe Performance Cookbook: Avoid Large JSON Blobs
    • Observe Performance Cookbook: Cast Data Columns Extracted from JSON
    • Observe Performance Cookbook: Create Intermediate Datasets
    • Observe Performance Cookbook: Filter Earlier in OPAL Scripts
    • Observe Performance Cookbook: Using Filter instead of Ever
    • Observe Performance Cookbook: Flatten Less First
    • Observe Performance Cookbook: Limit Worksheet Time Windows
    • Observe Performance Cookbook: Limit Resource Time Windows
    • Observe Performance Cookbook: Limit Valid Event Time Windows
    • Observe Performance Cookbook: Look for Hidden Columns
    • Observe Performance Cookbook: Use Make_Events before Window Functions
    • Observe Performance Cookbook: Mark Immutable Resource Columns
    • Observe Performance Cookbook: Making Resources from Multiple Datasets
    • Observe Performance Cookbook: Prefer Join to Lookup
    • Observe Performance Cookbook: Prefer Lead and Lag to First and Last
    • Observe Performance Cookbook: Prefer Timechart to Timestats
    • Observe Performance Cookbook: Limit Query Time Windows
    • Observe Performance Cookbook: Limit Query Time Windows
    • Observe Performance Cookbook: Reduce Columns Earlier in OPAL Scripts
    • Observe Performance Cookbook: Extract from JSON instead of using Flatten
    • Observe Performance Cookbook: Type Data Columns
    • Observe Performance Cookbook: Use Interval for Ephemeral Things
  • Conditional formatting
  • Units of measurement
  • Keyboard shortcuts
  • Helpful hints
    • How do I use a formula?
    • What characters are allowed in a field name?
    • How should I aggregate data?
    • How do I make a standard deviation anomaly detection monitor?
    • How do I find average values over time?
    • How do I change a field type?
    • Can I change the name of an Observe instance?
    • How do I compare time ranges in OPAL?
    • How to create an array from existing columns?
    • How do I compute a cumulative count over any interval grouped by multiple fields?
    • What is my customer ID?
    • OPAL duration conversion
    • How do I filter by a list of terms?
    • How do I test for multiple values in a dashboard parameter?
    • Filter out unwanted data
    • How do I Find the size of a column?
    • Formatting large numbers for readability
    • Helpful hints
    • How many monitors are we using?
    • How many queries are we using?
    • How much ingest and transform are we using?
    • How do I measure drift in a metric over time?
    • How do I sort dates by time when they are sorted alphabetically?
    • How to sort digits numerically when they are sorted alphabetically?
    • How do I map fields to each other?
    • How do I pivot a dataset?
    • How do I measure drift in a resource over time?
    • How do I unpivot data?
    • How do I make a service appear in Service Explorer?
    • Can I use OPAL to rename a dataset?
    • How do I prevent lost columns?
    • What is best practice for OPAL field extraction?
    • What is best practice for case statements in OPAL?
    • What is the best practice for field naming in OPAL?
    • What is best practice for managing the schema interface between datasets?
    • What is the best practice for using durations in OPAL?
    • OPAL case sensitive filtering with contains
    • OPAL case sensitive filtering with equals
    • OPAL case sensitive filtering with match_regex
    • OPAL case sensitive filtering with tilde and regex
    • OPAL case sensitive filtering with tilde
    • How do I compare values in OPAL?
    • How do I extract the numeric parts of a message?
    • How do I extract parameters from a URL?
    • How should I rollup aggregated data?
    • How do I search by time?
    • How to set the type of a column?
    • How do I split a field?
    • How do I calculate a running standard deviation?
    • What is the system datastream?
    • OPAL timestamp conversion
    • How do I find a weighted average?
    • How do I use time window functions?

Support Policies

  • Support policies
    • Observe support terms
    • Create an incident
    • Escalate an issue
    • View your requests
    • Share requests with your team
    • Support policy for accidental ingestion of sensitive data
    • The Observe system user
Back to top

set_link¶

Type of operation: Metadata

Description¶

Add a foreign key to the output, which identifies the target dataset and columns used to find a target resource.

Usage¶

set_link [ ^label ], keyfield_1, keyfield_2, ...

Argument

Type

Optional

Repeatable

Restrictions

^label

link

yes

no

link

keyfield

storable

no

yes

column

Accelerable¶

set_link is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples¶

set_link "Related Resource", src1:@target.dst1, src2:@target.dst2

Adds a foreign key that links to @target, matching dst1 and dst2 in the target to src1 and src2 in the current dataset. The key label is set to “Related Resource”.

set_link src1:@foo.dst1

Adds a foreign key that links to @foo, matching dst1 in the target to src1 in the current dataset. The key label is set from the existing label of the target @foo.

set_link "Account Name", src1:@target.dst1, src2:@target.dst2

Adds a foreign key that links to @target, matching dst1 in the target to src1 in the current dataset and matching dst2 in the target to src2 in the current dataset. The key label is set from the existing label of the target @target. So if the target dataset’s label is “Account”, the “Account” column will be used to fill the “Account Name” label for the source dataset.

If the target dataset doesn’t have a label, the first primary key of the target dataset will be selected to fill in the “Account Name” label regardless of how you set the order of the dst matches for the set_link verb. If the target dataset has dst1 as the first primary key, dst1 will be used to fill in the “Account Name” label.

Aliases¶

  • addfk (deprecated)

Next
set_metric
Previous
set_label
Copyright © 2017-2025 Observe, Inc.
Made with Furo

Have comments about the Observe docs?

On this page
  • set_link
    • Description
    • Usage
    • Accelerable
    • Examples
    • Aliases