PRODUCT
LEARN
CAREERS
ABOUT US

Hide navigation sidebar

Hide table of contents sidebar

Skip to content

Toggle site navigation sidebar

Observability Cloud documentation

Toggle table of contents sidebar

Welcome to Observe

Get started with Observe
Get help with Observe
Toggle navigation of Get help with Observe
- Tutorial: Use O11y Slack to manage an incident
- Support policies
  Toggle navigation of Support policies
Observe tutorials
Toggle navigation of Observe tutorials
What’s new

Send Data to Observe

Observe Agent
Toggle navigation of Observe Agent
APM instrumentation
Toggle navigation of APM instrumentation
LLM instrumentation
Toggle navigation of LLM instrumentation
RUM instrumentation
Toggle navigation of RUM instrumentation
- Using CDN script tags
- Instrument using the NPM package
Integrations
Toggle navigation of Integrations
- Observe apps
- Amazon Web Services (AWS)
  Toggle navigation of Amazon Web Services (AWS)
  - Amazon Web Services (AWS) Integration [Legacy]
  - Amazon CloudFront
  - Amazon EC2
  - Amazon Elastic Container Service
    Toggle navigation of Amazon Elastic Container Service
    - Amazon Elastic Container Service Metrics
    - Amazon Elastic Container Log Collection
  - Amazon RDS
    Toggle navigation of Amazon RDS
    - Amazon RDS Metrics
  - AWS Lambda
    Toggle navigation of AWS Lambda
    - AWS Lambda metrics
  - Elastic Load Balancing
    Toggle navigation of Elastic Load Balancing
    - Elastic Load Balancing Metrics
- AWS Quickstart
- Basic threat intel integration
  Toggle navigation of Basic threat intel integration
  - Install the basic threat intel app
  - Use unified basic threat intel Datasets with Observe
    Toggle navigation of Use unified basic threat intel Datasets with Observe
- Snowflake observability
  Toggle navigation of Snowflake observability
- Drata app (public preview)
  Toggle navigation of Drata app (public preview)
  - Install the Drata app
- Fastly (public preview)
  Toggle navigation of Fastly (public preview)
  - Install the Fastly app
  - Uninstall the Fastly app
- Google Cloud Platform (GCP) App [Legacy]
  Toggle navigation of Google Cloud Platform (GCP) App [Legacy]
  - GCP Asset Inventory
  - GCP BigQuery
  - GCP Cloud Functions
    Toggle navigation of GCP Cloud Functions
    - GCP Cloud Functions metrics
  - GCP Cloud Load Balancing
    Toggle navigation of GCP Cloud Load Balancing
    - GCP Cloud Load Balancing Metrics
  - GCP Cloud Run
    Toggle navigation of GCP Cloud Run
    - GCP Cloud Run Metrics
  - GCP Cloud SQL
    Toggle navigation of GCP Cloud SQL
    - GCP Cloud SQL Metrics
  - GCP Cloud Storage
    Toggle navigation of GCP Cloud Storage
    - GCP Cloud Storage Metrics
  - GCP Compute
    Toggle navigation of GCP Compute
    - GCP Compute Metrics
  - GCP logging
  - GCP cloud metrics
  - Google Kubernetes Engine
  - Memorystore Redis
- Google Cloud Platform quickstart
  Toggle navigation of Google Cloud Platform quickstart
  - Google Cloud Platform (GCP) ingesting data
- GitHub
  Toggle navigation of GitHub
- GitLab
  Toggle navigation of GitLab
- Host Monitoring [Legacy]
  Toggle navigation of Host Monitoring [Legacy]
  - Install the Host Monitoring app
    Toggle navigation of Install the Host Monitoring app
  - Uninstall the Host Monitoring app
- Host Quickstart
- Jenkins CI/CD integration
  Toggle navigation of Jenkins CI/CD integration
  - Install the Jenkins app
  - Uninstall the Jenkins app
- Kubernetes
  Toggle navigation of Kubernetes
  - Install the Kubernetes app
  - Collect pod metrics and cAdvisor metrics
- Microsoft Azure
  Toggle navigation of Microsoft Azure
- MongoDB Atlas
  Toggle navigation of MongoDB Atlas
  - Install the MongoDB Atlas app
  - Update the MongoDB Atlas app and poller
- MySQL Database Service
  Toggle navigation of MySQL Database Service
  - Install the MySQL DB app
  - Uninstall the MySQL DB app
- Prometheus Node Exporter
- OpenAI (deprecated)
- Orca Security app (public preview)
  Toggle navigation of Orca Security app (public preview)
  - Install the Orca Security app
- PostgreSQL Database Service
  Toggle navigation of PostgreSQL Database Service
  - Install the PostgreSQL DB app
  - Uninstall the PostgreSQL DB app
- Prometheus metrics (public preview)
  Toggle navigation of Prometheus metrics (public preview)
  - Install the Prometheus Metrics app
  - Tutorial: Gett started with Observe and Prometheus
- Security Onion app (public preview)
  Toggle navigation of Security Onion app (public preview)
  - Install the Security Onion app
- Service level objectives (SLOs)
  Toggle navigation of Service level objectives (SLOs)
  - Install the Service Level Objective app
Data ingestion
Toggle navigation of Data ingestion
- Datastreams
- Sources
  Toggle navigation of Sources
- Forwarders
  Toggle navigation of Forwarders
- Endpoints
  Toggle navigation of Endpoints
- Troubleshooting data ingestion

Products

Log management
Toggle navigation of Log management
- Log Explorer
- Use log correlation
- Use live mode in Logs Explorer
- Add new datasets to Log Explorer
- Unified Search syntax
  Toggle navigation of Unified Search syntax
  - Migrate to Unified Search syntax
Application Performance Monitoring
Toggle navigation of Application Performance Monitoring
LLM observability
Toggle navigation of LLM observability
- LLM telemetry reference
Frontend observability
Toggle navigation of Frontend observability
- RUM telemetry reference
Metrics
Toggle navigation of Metrics
Kubernetes observability
Toggle navigation of Kubernetes observability
Snowflake observability
Toggle navigation of Snowflake observability
Model Context Protocol (MCP) - Private Preview

Platform Capabilities

Create dashboards
Toggle navigation of Create dashboards
- Use dashboards to visualize data
- Generate dashboard reports
Monitors and alerts
Toggle navigation of Monitors and alerts
- Create a threshold monitor
- Create a count monitor
- Create a promote monitor
- Monitor rules and severities
- Mute monitors
- Overview of shared actions
  Toggle navigation of Overview of shared actions
  - Customize alert messages
  - Mustache template reference
- Alerting example: shared actions and monitors
- Work with alerts in Observe
- Tune and troubleshoot monitor health
- Negative Monitoring
- Monitor anti-patterns
- Shared action integrations
  Toggle navigation of Shared action integrations
  - Sample action for Microsoft Teams
  - PagerDuty
Create and share worksheets
Toggle navigation of Create and share worksheets
- Work with data formats and types
Pivot between data types
Correlation tags
Resources
Data export
Drop filters

Manage Observe

Authentication and authorization
Toggle navigation of Authentication and authorization
Manage application data volume
Customize the Home page
Toggle navigation of Customize the Home page
- Create and use favorites
Use Acceleration Manager with Datasets
Use Credit Manager to manage compute usage
Toggle navigation of Use Credit Manager to manage compute usage
Observe Terraform provider
Observe regions
Settings

Develop with Observe

Export query results
Developer toolkit overview
URL query parameters
CLI tool overview
Toggle navigation of CLI tool overview
Snowflake outbound sharing

Reference

Key Observe concepts
Toggle navigation of Key Observe concepts
- Advanced Observe concepts
- Explore data
- About queries and on-demand acceleration
- Observe Datasets and time
  Toggle navigation of Observe Datasets and time
Visualization types
OPAL reference
Toggle navigation of OPAL reference
- What is OPAL?
- OPAL language syntax
- OPAL data types and operators
- Performance cookbook
  Toggle navigation of Performance cookbook
- OPAL examples
- All OPAL functions
  Toggle navigation of All OPAL functions
  - OPAL Functions By Category
    Toggle navigation of OPAL Functions By Category
    - OPAL Aggregate Functions
      Toggle navigation of OPAL Aggregate Functions
      - any
      - any_not_null
      - array_agg
      - array_agg_distinct
      - array_union_agg
      - avg
      - count
      - count_distinct
      - count_distinct_exact
      - delta
      - delta_monotonic
      - deriv
      - first
      - first_not_null
      - hash_agg
      - hash_agg_distinct
      - histogram_combine
      - last
      - last_not_null
      - max
      - median
      - median_exact
      - min
      - object_agg
      - otel_exponential_histogram_sum
      - otel_histogram_sum
      - percentile
      - percentile_cont
      - percentile_disc
      - prom_quantile
      - rate
      - stddev
      - string_agg
      - string_agg_distinct
      - sum
      - tdigest_agg
      - tdigest_combine
      - topk_agg
    - OPAL Boolean Functions
      Toggle navigation of OPAL Boolean Functions
      - array_contains
      - arrays_overlap
      - bool
      - bool_null
      - contains
      - ends_with
      - eq
      - gt
      - gte
      - in
      - ipv4_address_in_network
      - is_null
      - like
      - lt
      - lte
      - match_regex
      - ne
      - path_exists
      - same
      - search
      - starts_with
    - OPAL Misc Functions
      Toggle navigation of OPAL Misc Functions
      - asc
      - coalesce
      - desc
      - exponential_histogram_null
      - float64
      - frame
      - frame_exact
      - frame_following
      - frame_preceding
      - hash
      - histogram_null
      - histogram_quantile
      - if
      - if_null
      - int64
      - m_exponential_histogram
      - m_histogram
      - m_tdigest
      - nullsfirst
      - nullslast
      - numeric_null
      - on
      - order_by
      - parse_hex
      - strlen
      - tdigest
      - tdigest_null
      - variant_null
    - OPAL Networking Functions
      Toggle navigation of OPAL Networking Functions
    - OPAL Numeric Functions
      Toggle navigation of OPAL Numeric Functions
      - abs
      - arccos_deg
      - arccos_rad
      - arcsin_deg
      - arcsin_rad
      - arctan_deg
      - arctan_rad
      - avg
      - ceil
      - cos_deg
      - cos_rad
      - count
      - degrees
      - delta
      - delta_monotonic
      - dense_rank
      - deriv
      - ewma
      - exp
      - float64_null
      - floor
      - haversine_distance_km
      - int64_null
      - int_div
      - ln
      - log
      - median
      - median_exact
      - mod
      - percentile
      - percentile_cont
      - percentile_disc
      - pi
      - pow
      - prom_quantile
      - radians
      - rank
      - rate
      - round
      - row_number
      - sin_deg
      - sin_rad
      - sqrt
      - stddev
      - sum
      - tan_deg
      - tan_rad
      - uniform
      - width_bucket
      - zipf
    - OPAL Regex Functions
      Toggle navigation of OPAL Regex Functions
    - OPAL Semistructured Functions
      Toggle navigation of OPAL Semistructured Functions
    - OPAL Special Functions
      Toggle navigation of OPAL Special Functions
      - case
      - group_by
      - m
      - metric
      - options
      - primary_key
      - pk
      - tags
      - valid_for
      - window
    - OPAL String Functions
      Toggle navigation of OPAL String Functions
      - array_to_string
      - check_json
      - concat_strings
      - contains
      - decode_base64
      - decode_uri
      - decode_uri_component
      - detect_browser
      - editdistance
      - embed_sql_params
      - encode_base64
      - encode_uri
      - encode_uri_component
      - ends_with
      - format_time
      - get_regex
      - int64_to_ipv4
      - ipv4_address_in_network
      - label
      - left
      - like
      - lower
      - lpad
      - ltrim
      - parse_csv
      - parse_kvs
      - parse_timestamp
      - pivot_array
      - position
      - regex
      - replace
      - replace_regex
      - right
      - rpad
      - rtrim
      - sha2
      - split
      - split_part
      - starts_with
      - string
      - string_agg
      - string_agg_distinct
      - string_null
      - substring
      - tokenize
      - tokenize_part
      - trim
      - unpivot_array
      - upper
      - variant_type_name
    - OPAL Time Functions
      Toggle navigation of OPAL Time Functions
      - abs
      - avg
      - bin_end_time
      - bin_size
      - bin_start_time
      - delta
      - delta_monotonic
      - deriv
      - duration
      - duration_hr
      - duration_min
      - duration_ms
      - duration_null
      - duration_sec
      - ewma
      - format_time
      - from_milliseconds
      - timestamp_ms
      - from_nanoseconds
      - timestamp_ns
      - from_seconds
      - timestamp_s
      - histogram_fraction
      - median
      - median_exact
      - now
      - parse_duration
      - parse_isotime
      - parse_timestamp
      - percentile
      - percentile_cont
      - percentile_disc
      - query_end_time
      - query_start_time
      - rate
      - row_end_time
      - row_timestamp
      - row_start_time
      - stddev
      - sum
      - tdigest_agg
      - tdigest_quantile
      - timestamp_null
      - to_days
      - to_hours
      - to_milliseconds
      - to_minutes
      - to_nanoseconds
      - to_seconds
      - to_weeks
      - valid_for
    - OPAL Window Functions
      Toggle navigation of OPAL Window Functions
      - any
      - any_not_null
      - array_union_agg
      - avg
      - count
      - count_distinct
      - count_distinct_exact
      - delta
      - delta_monotonic
      - dense_rank
      - deriv
      - ewma
      - first
      - first_not_null
      - hash_agg
      - hash_agg_distinct
      - lag
      - lag_not_null
      - last
      - last_not_null
      - lead
      - lead_not_null
      - max
      - median
      - median_exact
      - min
      - object_agg
      - percentile
      - percentile_cont
      - percentile_disc
      - rank
      - rate
      - row_number
      - stddev
      - sum
      - tdigest_agg
      - tdigest_combine
      - topk_agg
    - OPAL Deprecated Function Aliases
      Toggle navigation of OPAL Deprecated Function Aliases
      - any_null
      - array_pivot
      - array_unpivot
      - countdistinct
      - countdistinctexact
      - decodebase64
      - denserank
      - encodebase64
      - endswith
      - groupby
      - ifnull
      - isnull
      - makeobject
      - match_regex_all
      - medianexact
      - milliseconds
      - nanoseconds
      - orderby
      - parsehex
      - parseip
      - parseisotime
      - parsejson
      - parsekvs
      - parseurl
      - percentilecont
      - percentiledisc
      - primarykey
      - queryendtime
      - querystarttime
      - regex_match
      - regex_replace
      - row_endtime
      - rownumber
      - seconds
      - startswith
      - strcat
      - string_concat
      - validfor
- OPAL Functions By Category
  Toggle navigation of OPAL Functions By Category
  - OPAL Aggregate Functions
    Toggle navigation of OPAL Aggregate Functions
    - any
    - any_not_null
    - array_agg
    - array_agg_distinct
    - array_union_agg
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - delta
    - delta_monotonic
    - deriv
    - first
    - first_not_null
    - hash_agg
    - hash_agg_distinct
    - histogram_combine
    - last
    - last_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - otel_exponential_histogram_sum
    - otel_histogram_sum
    - percentile
    - percentile_cont
    - percentile_disc
    - prom_quantile
    - rate
    - stddev
    - string_agg
    - string_agg_distinct
    - sum
    - tdigest_agg
    - tdigest_combine
    - topk_agg
  - OPAL Boolean Functions
    Toggle navigation of OPAL Boolean Functions
    - array_contains
    - arrays_overlap
    - bool
    - bool_null
    - contains
    - ends_with
    - eq
    - gt
    - gte
    - in
    - ipv4_address_in_network
    - is_null
    - like
    - lt
    - lte
    - match_regex
    - ne
    - path_exists
    - same
    - search
    - starts_with
  - OPAL Misc Functions
    Toggle navigation of OPAL Misc Functions
    - asc
    - coalesce
    - desc
    - exponential_histogram_null
    - float64
    - frame
    - frame_exact
    - frame_following
    - frame_preceding
    - hash
    - histogram_null
    - histogram_quantile
    - if
    - if_null
    - int64
    - m_exponential_histogram
    - m_histogram
    - m_tdigest
    - nullsfirst
    - nullslast
    - numeric_null
    - on
    - order_by
    - parse_hex
    - strlen
    - tdigest
    - tdigest_null
    - variant_null
  - OPAL Networking Functions
    Toggle navigation of OPAL Networking Functions
  - OPAL Numeric Functions
    Toggle navigation of OPAL Numeric Functions
    - abs
    - arccos_deg
    - arccos_rad
    - arcsin_deg
    - arcsin_rad
    - arctan_deg
    - arctan_rad
    - avg
    - ceil
    - cos_deg
    - cos_rad
    - count
    - degrees
    - delta
    - delta_monotonic
    - dense_rank
    - deriv
    - ewma
    - exp
    - float64_null
    - floor
    - haversine_distance_km
    - int64_null
    - int_div
    - ln
    - log
    - median
    - median_exact
    - mod
    - percentile
    - percentile_cont
    - percentile_disc
    - pi
    - pow
    - prom_quantile
    - radians
    - rank
    - rate
    - round
    - row_number
    - sin_deg
    - sin_rad
    - sqrt
    - stddev
    - sum
    - tan_deg
    - tan_rad
    - uniform
    - width_bucket
    - zipf
  - OPAL Regex Functions
    Toggle navigation of OPAL Regex Functions
  - OPAL Semistructured Functions
    Toggle navigation of OPAL Semistructured Functions
  - OPAL Special Functions
    Toggle navigation of OPAL Special Functions
    - case
    - group_by
    - m
    - metric
    - options
    - primary_key
    - pk
    - tags
    - valid_for
    - window
  - OPAL String Functions
    Toggle navigation of OPAL String Functions
    - array_to_string
    - check_json
    - concat_strings
    - contains
    - decode_base64
    - decode_uri
    - decode_uri_component
    - detect_browser
    - editdistance
    - embed_sql_params
    - encode_base64
    - encode_uri
    - encode_uri_component
    - ends_with
    - format_time
    - get_regex
    - int64_to_ipv4
    - ipv4_address_in_network
    - label
    - left
    - like
    - lower
    - lpad
    - ltrim
    - parse_csv
    - parse_kvs
    - parse_timestamp
    - pivot_array
    - position
    - regex
    - replace
    - replace_regex
    - right
    - rpad
    - rtrim
    - sha2
    - split
    - split_part
    - starts_with
    - string
    - string_agg
    - string_agg_distinct
    - string_null
    - substring
    - tokenize
    - tokenize_part
    - trim
    - unpivot_array
    - upper
    - variant_type_name
  - OPAL Time Functions
    Toggle navigation of OPAL Time Functions
    - abs
    - avg
    - bin_end_time
    - bin_size
    - bin_start_time
    - delta
    - delta_monotonic
    - deriv
    - duration
    - duration_hr
    - duration_min
    - duration_ms
    - duration_null
    - duration_sec
    - ewma
    - format_time
    - from_milliseconds
    - timestamp_ms
    - from_nanoseconds
    - timestamp_ns
    - from_seconds
    - timestamp_s
    - histogram_fraction
    - median
    - median_exact
    - now
    - parse_duration
    - parse_isotime
    - parse_timestamp
    - percentile
    - percentile_cont
    - percentile_disc
    - query_end_time
    - query_start_time
    - rate
    - row_end_time
    - row_timestamp
    - row_start_time
    - stddev
    - sum
    - tdigest_agg
    - tdigest_quantile
    - timestamp_null
    - to_days
    - to_hours
    - to_milliseconds
    - to_minutes
    - to_nanoseconds
    - to_seconds
    - to_weeks
    - valid_for
  - OPAL Window Functions
    Toggle navigation of OPAL Window Functions
    - any
    - any_not_null
    - array_union_agg
    - avg
    - count
    - count_distinct
    - count_distinct_exact
    - delta
    - delta_monotonic
    - dense_rank
    - deriv
    - ewma
    - first
    - first_not_null
    - hash_agg
    - hash_agg_distinct
    - lag
    - lag_not_null
    - last
    - last_not_null
    - lead
    - lead_not_null
    - max
    - median
    - median_exact
    - min
    - object_agg
    - percentile
    - percentile_cont
    - percentile_disc
    - rank
    - rate
    - row_number
    - stddev
    - sum
    - tdigest_agg
    - tdigest_combine
    - topk_agg
  - OPAL Deprecated Function Aliases
    Toggle navigation of OPAL Deprecated Function Aliases
    - any_null
    - array_pivot
    - array_unpivot
    - countdistinct
    - countdistinctexact
    - decodebase64
    - denserank
    - encodebase64
    - endswith
    - groupby
    - ifnull
    - isnull
    - makeobject
    - match_regex_all
    - medianexact
    - milliseconds
    - nanoseconds
    - orderby
    - parsehex
    - parseip
    - parseisotime
    - parsejson
    - parsekvs
    - parseurl
    - percentilecont
    - percentiledisc
    - primarykey
    - queryendtime
    - querystarttime
    - regex_match
    - regex_replace
    - row_endtime
    - rownumber
    - seconds
    - startswith
    - strcat
    - string_concat
    - validfor
- OPAL Aggregate Functions
  Toggle navigation of OPAL Aggregate Functions
  - any
  - any_not_null
  - array_agg
  - array_agg_distinct
  - array_union_agg
  - avg
  - count
  - count_distinct
  - count_distinct_exact
  - delta
  - delta_monotonic
  - deriv
  - first
  - first_not_null
  - hash_agg
  - hash_agg_distinct
  - histogram_combine
  - last
  - last_not_null
  - max
  - median
  - median_exact
  - min
  - object_agg
  - otel_exponential_histogram_sum
  - otel_histogram_sum
  - percentile
  - percentile_cont
  - percentile_disc
  - prom_quantile
  - rate
  - stddev
  - string_agg
  - string_agg_distinct
  - sum
  - tdigest_agg
  - tdigest_combine
  - topk_agg
- OPAL alignment functions
  Toggle navigation of OPAL alignment functions
  - any
  - any_not_null
  - avg
  - count
  - count_distinct
  - count_distinct_exact
  - delta
  - delta_monotonic
  - deriv
  - first
  - first_not_null
  - last
  - last_not_null
  - max
  - median
  - median_exact
  - min
  - object_agg
  - percentile
  - percentile_cont
  - percentile_disc
  - prom_quantile
  - rate
  - stddev
  - sum
  - tdigest_agg
  - tdigest_combine
  - topk_agg
- OPAL Boolean Functions
  Toggle navigation of OPAL Boolean Functions
  - array_contains
  - arrays_overlap
  - bool
  - bool_null
  - contains
  - ends_with
  - eq
  - gt
  - gte
  - in
  - ipv4_address_in_network
  - is_null
  - like
  - lt
  - lte
  - match_regex
  - ne
  - path_exists
  - same
  - search
  - starts_with
- OPAL case sensitivity
- OPAL Numeric Functions
  Toggle navigation of OPAL Numeric Functions
  - abs
  - arccos_deg
  - arccos_rad
  - arcsin_deg
  - arcsin_rad
  - arctan_deg
  - arctan_rad
  - avg
  - ceil
  - cos_deg
  - cos_rad
  - count
  - degrees
  - delta
  - delta_monotonic
  - dense_rank
  - deriv
  - ewma
  - exp
  - float64_null
  - floor
  - haversine_distance_km
  - int64_null
  - int_div
  - ln
  - log
  - median
  - median_exact
  - mod
  - percentile
  - percentile_cont
  - percentile_disc
  - pi
  - pow
  - prom_quantile
  - radians
  - rank
  - rate
  - round
  - row_number
  - sin_deg
  - sin_rad
  - sqrt
  - stddev
  - sum
  - tan_deg
  - tan_rad
  - uniform
  - width_bucket
  - zipf
- OPAL Regex Functions
  Toggle navigation of OPAL Regex Functions
- OPAL Semistructured Functions
  Toggle navigation of OPAL Semistructured Functions
- OPAL Special Functions
  Toggle navigation of OPAL Special Functions
  - case
  - group_by
  - m
  - metric
  - options
  - primary_key
  - pk
  - tags
  - valid_for
  - window
- OPAL Time Functions
  Toggle navigation of OPAL Time Functions
  - abs
  - avg
  - bin_end_time
  - bin_size
  - bin_start_time
  - delta
  - delta_monotonic
  - deriv
  - duration
  - duration_hr
  - duration_min
  - duration_ms
  - duration_null
  - duration_sec
  - ewma
  - format_time
  - from_milliseconds
  - timestamp_ms
  - from_nanoseconds
  - timestamp_ns
  - from_seconds
  - timestamp_s
  - histogram_fraction
  - median
  - median_exact
  - now
  - parse_duration
  - parse_isotime
  - parse_timestamp
  - percentile
  - percentile_cont
  - percentile_disc
  - query_end_time
  - query_start_time
  - rate
  - row_end_time
  - row_timestamp
  - row_start_time
  - stddev
  - sum
  - tdigest_agg
  - tdigest_quantile
  - timestamp_null
  - to_days
  - to_hours
  - to_milliseconds
  - to_minutes
  - to_nanoseconds
  - to_seconds
  - to_weeks
  - valid_for
- Parsing time strings in OPAL
- OPAL Networking Functions
  Toggle navigation of OPAL Networking Functions
- OPAL Window Functions
  Toggle navigation of OPAL Window Functions
  - any
  - any_not_null
  - array_union_agg
  - avg
  - count
  - count_distinct
  - count_distinct_exact
  - delta
  - delta_monotonic
  - dense_rank
  - deriv
  - ewma
  - first
  - first_not_null
  - hash_agg
  - hash_agg_distinct
  - lag
  - lag_not_null
  - last
  - last_not_null
  - lead
  - lead_not_null
  - max
  - median
  - median_exact
  - min
  - object_agg
  - percentile
  - percentile_cont
  - percentile_disc
  - rank
  - rate
  - row_number
  - stddev
  - sum
  - tdigest_agg
  - tdigest_combine
  - topk_agg
- OPAL Misc Functions
  Toggle navigation of OPAL Misc Functions
  - asc
  - coalesce
  - desc
  - exponential_histogram_null
  - float64
  - frame
  - frame_exact
  - frame_following
  - frame_preceding
  - hash
  - histogram_null
  - histogram_quantile
  - if
  - if_null
  - int64
  - m_exponential_histogram
  - m_histogram
  - m_tdigest
  - nullsfirst
  - nullslast
  - numeric_null
  - on
  - order_by
  - parse_hex
  - strlen
  - tdigest
  - tdigest_null
  - variant_null
- OPAL Deprecated Function Aliases
  Toggle navigation of OPAL Deprecated Function Aliases
  - any_null
  - array_pivot
  - array_unpivot
  - countdistinct
  - countdistinctexact
  - decodebase64
  - denserank
  - encodebase64
  - endswith
  - groupby
  - ifnull
  - isnull
  - makeobject
  - match_regex_all
  - medianexact
  - milliseconds
  - nanoseconds
  - orderby
  - parsehex
  - parseip
  - parseisotime
  - parsejson
  - parsekvs
  - parseurl
  - percentilecont
  - percentiledisc
  - primarykey
  - queryendtime
  - querystarttime
  - regex_match
  - regex_replace
  - row_endtime
  - rownumber
  - seconds
  - startswith
  - strcat
  - string_concat
  - validfor
- All OPAL verbs
  Toggle navigation of All OPAL verbs
  - OPAL Verbs By Category
    Toggle navigation of OPAL Verbs By Category
    - OPAL Aggregate Verbs
      Toggle navigation of OPAL Aggregate Verbs
      - aggregate
      - align
      - dedup
      - distinct
      - fill
      - histogram
      - make_reference
      - make_session
      - merge_events
      - pivot
      - rollup
      - statsby
      - timechart
      - bucketize
      - timestats
      - unpivot
    - OPAL Filter Verbs
      Toggle navigation of OPAL Filter Verbs
      - always
      - bottomk
      - ever
      - filter
      - filter_last
      - limit
      - never
      - topk
    - OPAL Join Verbs
      Toggle navigation of OPAL Join Verbs
      - exists
      - follow
      - follow_not
      - fulljoin
      - join
      - leftjoin
      - lookup
      - lookup_ip_info
      - not_exists
      - surrounding
      - union
      - update_resource
    - OPAL Metadata Verbs
      Toggle navigation of OPAL Metadata Verbs
    - OPAL Metrics Verbs
      Toggle navigation of OPAL Metrics Verbs
      - aggregate
      - align
      - make_metric
      - rollup
      - set_metric
      - timeshift
    - OPAL Projection Verbs
      Toggle navigation of OPAL Projection Verbs
    - OPAL Semistructured Verbs
      Toggle navigation of OPAL Semistructured Verbs
    - OPAL Deprecated Verb Aliases
      Toggle navigation of OPAL Deprecated Verb Aliases
      - addfk
      - addkey
      - addmetric
      - changelog
      - coldrop
      - colenum
      - colimmutable
      - colmake
      - colpick
      - colregex
      - colrename
      - colshow
      - droptime
      - fkdrop
      - flattenall
      - flattenleaves
      - flattensingle
      - makeresource
      - makesession
      - merge_event
      - mergeevent
      - reaggregate
      - setlabel
      - setpk
      - setvf
      - setvt
- OPAL Verbs By Category
  Toggle navigation of OPAL Verbs By Category
  - OPAL Aggregate Verbs
    Toggle navigation of OPAL Aggregate Verbs
    - aggregate
    - align
    - dedup
    - distinct
    - fill
    - histogram
    - make_reference
    - make_session
    - merge_events
    - pivot
    - rollup
    - statsby
    - timechart
    - bucketize
    - timestats
    - unpivot
  - OPAL Filter Verbs
    Toggle navigation of OPAL Filter Verbs
    - always
    - bottomk
    - ever
    - filter
    - filter_last
    - limit
    - never
    - topk
  - OPAL Join Verbs
    Toggle navigation of OPAL Join Verbs
    - exists
    - follow
    - follow_not
    - fulljoin
    - join
    - leftjoin
    - lookup
    - lookup_ip_info
    - not_exists
    - surrounding
    - union
    - update_resource
  - OPAL Metadata Verbs
    Toggle navigation of OPAL Metadata Verbs
  - OPAL Metrics Verbs
    Toggle navigation of OPAL Metrics Verbs
    - aggregate
    - align
    - make_metric
    - rollup
    - set_metric
    - timeshift
  - OPAL Projection Verbs
    Toggle navigation of OPAL Projection Verbs
  - OPAL Semistructured Verbs
    Toggle navigation of OPAL Semistructured Verbs
  - OPAL Deprecated Verb Aliases
    Toggle navigation of OPAL Deprecated Verb Aliases
    - addfk
    - addkey
    - addmetric
    - changelog
    - coldrop
    - colenum
    - colimmutable
    - colmake
    - colpick
    - colregex
    - colrename
    - colshow
    - droptime
    - fkdrop
    - flattenall
    - flattenleaves
    - flattensingle
    - makeresource
    - makesession
    - merge_event
    - mergeevent
    - reaggregate
    - setlabel
    - setpk
    - setvf
    - setvt
- OPAL Aggregate Verbs
  Toggle navigation of OPAL Aggregate Verbs
  - aggregate
  - align
  - dedup
  - distinct
  - fill
  - histogram
  - make_reference
  - make_session
  - merge_events
  - pivot
  - rollup
  - statsby
  - timechart
  - bucketize
  - timestats
  - unpivot
- OPAL Filter Verbs
  Toggle navigation of OPAL Filter Verbs
  - always
  - bottomk
  - ever
  - filter
  - filter_last
  - limit
  - never
  - topk
- OPAL Join Verbs
  Toggle navigation of OPAL Join Verbs
  - exists
  - follow
  - follow_not
  - fulljoin
  - join
  - leftjoin
  - lookup
  - lookup_ip_info
  - not_exists
  - surrounding
  - union
  - update_resource
- OPAL Metrics Verbs
  Toggle navigation of OPAL Metrics Verbs
  - aggregate
  - align
  - make_metric
  - rollup
  - set_metric
  - timeshift
- OPAL Projection Verbs
  Toggle navigation of OPAL Projection Verbs
- OPAL Semistructured Verbs
  Toggle navigation of OPAL Semistructured Verbs
- OPAL Metadata Verbs
  Toggle navigation of OPAL Metadata Verbs
- OPAL Deprecated Verb Aliases
  Toggle navigation of OPAL Deprecated Verb Aliases
  - addfk
  - addkey
  - addmetric
  - changelog
  - coldrop
  - colenum
  - colimmutable
  - colmake
  - colpick
  - colregex
  - colrename
  - colshow
  - droptime
  - fkdrop
  - flattenall
  - flattenleaves
  - flattensingle
  - makeresource
  - makesession
  - merge_event
  - mergeevent
  - reaggregate
  - setlabel
  - setpk
  - setvf
  - setvt
Observasaurus
Toggle navigation of Observasaurus
Conditional formatting
Units of measurement
Keyboard shortcuts
Helpful hints
Toggle navigation of Helpful hints

Toggle table of contents sidebar

Support policies¶

Please see the links below for detailed information about each of our support policies.

Observe support terms
Create an incident
Escalate an issue
View your requests
Share requests with your team
Support policy for accidental ingestion of sensitive data
The Observe system user

Observe support terms

Tutorial: Use O11y Slack to manage an incident

Copyright © 2017-2025 Observe, Inc.

Made with Furo

Have comments about the Observe docs?