On This Page

Home / Search/ Language Reference/Index of Operators and Functions

Index of Operators and Functions

An alphabetical indes of all Cribl Search KQL identifiers.


This page provides a global, alphabetical indes of all operators and functions in the Cribl Search KQL implementation. Mathematical symbols for equality and inequality operators precede letters. Each operator or function is linked to its reference page and type.

Operator/FunctionType
== (equals, case-sensitive)Operator
=~ (equals, case-insensitive)Operator
!= (not equals, case-sensitive)Operator
!~ (not equals, case-insensitive)Operator
absMathematical function
acosMathematical function
agoDateTime function
asinMathematical function
atanMathematical function
atan2Mathematical function
avgStatistical function
avgifStatistical function
bag_has_keyDynamic function
bag_keysDynamic function
bag_mergeDynamic function
bag_packDynamic function
bag_pack_columnsDynamic function
bag_remove_keysDynamic function
bag_set_keyDynamic function
bag_zipDynamic function
base64_decode_toarrayString function
base64_decode_tostringString function
base64_encode_fromarrayString function
base64_encode_tostringString function
beta_cdfMathematical function
beta_invMathematical function
beta_pdfMathematical function
binConversion function
bin_autoConversion function
binary_andBinary function
binary_notBinary function
binary_orBinary function
binary_shift_leftBinary function
binary_shift_rightBinary function
binary_xorBinary function
boolType
.cancelCommand
caseConditional function
ceilMathematical function
ceilingMathematical function
.clear optionsCommand
centralizeOperator
coalesceConditional function
containsOperator
contains_csOperator
!containsOperator
!contains_csOperator
cosMathematical function
cotMathematical function
countOperator
countStatistical function
countifStatistical function
countofString function
criblOperator
datetimeType
datetime_addDateTime function
datetime_diffDateTime function
datetime_partDateTime function
dayofmonthDateTime function
dayofweekDateTime function
dayofyearDateTime function
dcountStatistical function
dcountifStatistical function
decimalType
dedupOperator
degreesMathematical function
distinctOperator
doubleType
dynamicType
endofdayDateTime function
endofmonthDateTime function
endofweekDateTime function
endofyearDateTime function
endswithOperator
!endswithOperator
endswith_csOperator
!endswith_csOperator
eventstatsOperator
expMathematical function
exp10Mathematical function
exp2Mathematical function
exportOperator
extendOperator
externaldataOperator
extractString function
extractOperator
extract_allString function
extract_jsonString function
findOperator
findearliestCribl function
findearliestifCribl function
findfirstCribl function
findfirstifCribl function
findlastCribl function
findlastifCribl function
findlatestCribl function
findlatestifCribl function
floorConversion function
foldkeysOperator
format_bytesINET function
format_datetimeDateTime function
format_ipv4INET function
format_ipv4_maskINET function
format_timespanDateTime function
from_binary_stringBinary function
gammaMathematical function
.generate statsCommand
getmonthDateTime function
gettypeConversion function
getyearDateTime function
hasOperator
!hasOperator
has_allOperator
!has_allOperator
has_anyOperator
!has_anyOperator
has_any_indexString function
has_csOperator
!has_csOperator
!hasprefixOperator
!hasprefix_csOperator
!hassuffixOperator
!hassuffix_csOperator
hashHash function
hash_combineHash function
hash_manyHash function
hash_md5Hash function
hash_sha1Hash function
hash_sha256Hash function
hash_xxhash64Hash function
hasprefixOperator
hasprefix_csOperator
hassuffixOperator
hassuffix_csOperator
hourofdayDateTime function
iffConditional function
iifConditional function
inOperator
indexofString function
intType
in~Operator
!inOperator
!in~Operator
ip-lookupOperator
ipv4_compareINET function
ipv4_is_in_any_rangeINET function
ipv4_is_in_rangeINET function
ipv4_is_matchINET function
ipv4_is_privateINET function
ipv4_netmask_suffixINET function
ipv6_compareINET function
ipv6_is_matchINET function
isemptyString function
isfiniteMathematical function
isinfMathematical function
isnanMathematical function
isnotemptyString function
isnotnullString function
isnullString function
joinOperator
letStatement
limitOperator
listCribl function
logMathematical function
log10Mathematical function
log2Mathematical function
loggammaMathematical function
longType
lookupOperator
make_bagDynamic function
make_bag_ifDynamic function
make_datetimeDateTime function
make_timespanDateTime function
match_regexString function
matches regexOperator
maxStatistical function
max_ofConditional function
maxifStatistical function
medianCribl function
medianifCribl function
minStatistical function
min_ofConditional function
minifStatistical function
monthofyearDateTime function
mv-expandOperator
mv-pullOperator
nextWindow function
notMathematical function
nowDateTime function
nullType
orderOperator
parse_csvString function
parse_ipv4String function
parse_ipv4_maskString function
parse_ipv6String function
parse_ipv6_maskString function
parse_jsonString function
parse_urlString function
parse_urlqueryString function
parse_versionString function
percentileStatistical function
persecondCribl function
persecondifCribl function
piMathematical function
pivotOperator
powMathematical function
prevWindow function
printOperator
projectOperator
project-awayOperator
project-renameOperator
radiansMathematical function
randMathematical function
rangeOperator
rangeMathematical function
rateCribl function
rateifCribl function
realType
renderOperator
replace_regexString function
reverseString function
roundMathematical function
row_cumsumWindow function
row_numberWindow function
row_rank_denseWindow function
row_rank_minWindow function
row_window_sessionWindow function
searchOperator
sendOperator
setStatement
.show objectsCommand
.show optionsCommand
.show queriesCommand
signMathematical function
sinMathematical function
sortOperator
splitString function
sqrtMathematical function
startofdayDateTime function
startofmonthDateTime function
startofweekDateTime function
startofyearDateTime function
startswithOperator
!startswithOperator
startswith_csOperator
!startswith_csOperator
stdevStatistical function
stdevifStatistical function
stdevpStatistical function
strcatString function
strcat_delimString function
strcmpString function
strftimeDateTime function
stringType
strlenString function
strptimeDateTime function
strrepString function
substringString function
sumStatistical function
sumifStatistical function
summarizeOperator
sumsqCribl function
sumsqifCribl function
takeOperator
tanMathematical function
timespanType
timestatsOperator
to_binary_stringBinary function
toboolConversion function
todatetimeDateTime function
todecimalConversion function
todoubleConversion function
tointConversion function
tolongConversion function
tolowerString function
topOperator
top-hittersOperator
torealConversion function
tostringConversion function
totimespanDateTime function
toupperString function
translateString function
trimString function
trim_endString function
trim_startString function
unionOperator
unixtime_microseconds_todatetimeDateTime function
unixtime_milliseconds_todatetimeDateTime function
unixtime_nanoseconds_todatetimeDateTime function
unixtime_seconds_todatetimeDateTime function
url_decodeString function
url_encodeString function
valuesCribl function
varianceStatistical function
varianceifStatistical function
variancepStatistical function
$vt_dataset_providersVirtual table
$vt_datasetsVirtual table
$vt_dummyVirtual table
$vt_jobsVirtual table
$vt_listVirtual table
$vt_lookupsVirtual table
$vt_resultsVirtual table
week_of_yearDateTime function
whereOperator
zipDynamic function