Language Reference Index

An alphabetical index of all Cribl Search KQL elements.

This page provides a global, alphabetical index of all elements of the Cribl Search KQL language implementation: operators, functions, commands, statements, virtual tables, and supported types.

Mathematical symbols for equality and inequality operators precede letters. Each building block is linked to its reference page and category.

Operator, Function, Element	Category
== (equals, case-sensitive)	Operator
=~ (equals, case-insensitive)	Operator
!= (not equals, case-sensitive)	Operator
!~ (not equals, case-insensitive)	Operator
abs	Mathematical function
acos	Mathematical function
ago	DateTime function
asin	Mathematical function
atan	Mathematical function
atan2	Mathematical function
avg	Statistical function
avgif	Statistical function
bag_has_key	Dynamic function
bag_keys	Dynamic function
bag_merge	Dynamic function
bag_pack	Dynamic function
bag_pack_columns	Dynamic function
bag_remove_keys	Dynamic function
bag_set_key	Dynamic function
bag_zip	Dynamic function
base64_decode_toarray	String function
base64_decode_tostring	String function
base64_encode_fromarray	String function
base64_encode_tostring	String function
beta_cdf	Mathematical function
beta_inv	Mathematical function
beta_pdf	Mathematical function
bin	Conversion function
bin_auto	Conversion function
binary_and	Binary function
binary_not	Binary function
binary_or	Binary function
binary_shift_left	Binary function
binary_shift_right	Binary function
binary_xor	Binary function
bool	Type
.cancel	Command
case	Conditional function
ceil	Mathematical function
ceiling	Mathematical function
.clear options	Command
centralize	Operator
coalesce	Conditional function
contains	Operator
contains_cs	Operator
!contains	Operator
!contains_cs	Operator
cos	Mathematical function
cot	Mathematical function
count	Operator
count	Statistical function
countif	Statistical function
countof	String function
cribl	Operator
datetime	Type
datetime_add	DateTime function
datetime_diff	DateTime function
datetime_part	DateTime function
dayofmonth	DateTime function
dayofweek	DateTime function
dayofyear	DateTime function
dcount	Statistical function
dcountif	Statistical function
decimal	Type
dedup	Operator
degrees	Mathematical function
distinct	Operator
double	Type
dynamic	Type
endofday	DateTime function
endofmonth	DateTime function
endofweek	DateTime function
endofyear	DateTime function
endswith	Operator
!endswith	Operator
endswith_cs	Operator
!endswith_cs	Operator
eventstats	Operator
exp	Mathematical function
exp10	Mathematical function
exp2	Mathematical function
export	Operator
extend	Operator
externaldata	Operator
extract	String function
extract	Operator
extract_all	String function
extract_json	String function
find	Operator
findearliest	Cribl function
findearliestif	Cribl function
findfirst	Cribl function
findfirstif	Cribl function
findlast	Cribl function
findlastif	Cribl function
findlatest	Cribl function
findlatestif	Cribl function
floor	Conversion function
foldkeys	Operator
format_bytes	INET function
format_datetime	DateTime function
format_ipv4	INET function
format_ipv4_mask	INET function
format_timespan	DateTime function
from_binary_string	Binary function
gamma	Mathematical function
.generate stats	Command
getmonth	DateTime function
gettype	Conversion function
getyear	DateTime function
has	Operator
!has	Operator
has_all	Operator
!has_all	Operator
has_any	Operator
!has_any	Operator
has_any_index	String function
has_cs	Operator
!has_cs	Operator
!hasprefix	Operator
!hasprefix_cs	Operator
!hassuffix	Operator
!hassuffix_cs	Operator
hash	Hash function
hash_combine	Hash function
hash_many	Hash function
hash_md5	Hash function
hash_sha1	Hash function
hash_sha256	Hash function
hash_xxhash64	Hash function
hasprefix	Operator
hasprefix_cs	Operator
hassuffix	Operator
hassuffix_cs	Operator
hourofday	DateTime function
iff	Conditional function
iif	Conditional function
in	Operator
indexof	String function
int	Type
in~	Operator
!in	Operator
!in~	Operator
ip-lookup	Operator
ipv4_compare	INET function
ipv4_is_in_any_range	INET function
ipv4_is_in_range	INET function
ipv4_is_match	INET function
ipv4_is_private	INET function
ipv4_netmask_suffix	INET function
ipv6_compare	INET function
ipv6_is_match	INET function
isempty	String function
isfinite	Mathematical function
isinf	Mathematical function
isnan	Mathematical function
isnotempty	String function
isnotnull	String function
isnull	String function
join	Operator
let	Statement
limit	Operator
list	Cribl function
log	Mathematical function
log10	Mathematical function
log2	Mathematical function
loggamma	Mathematical function
long	Type
lookup	Operator
make_bag	Dynamic function
make_bag_if	Dynamic function
make_datetime	DateTime function
make_timespan	DateTime function
match_regex	String function
matches regex	Operator
max	Statistical function
max_of	Conditional function
maxif	Statistical function
median	Cribl function
medianif	Cribl function
min	Statistical function
min_of	Conditional function
minif	Statistical function
monthofyear	DateTime function
mv-expand	Operator
mv-pull	Operator
next	Window function
not	Mathematical function
now	DateTime function
null	Type
order	Operator
parse_csv	String function
parse_ipv4	String function
parse_ipv4_mask	String function
parse_ipv6	String function
parse_ipv6_mask	String function
parse_json	String function
parse_url	String function
parse_urlquery	String function
parse_version	String function
percentile	Statistical function
persecond	Cribl function
persecondif	Cribl function
pi	Mathematical function
pivot	Operator
pow	Mathematical function
prev	Window function
print	Operator
project	Operator
project-away	Operator
project-rename	Operator
radians	Mathematical function
rand	Mathematical function
range	Operator
range	Mathematical function
rate	Cribl function
rateif	Cribl function
real	Type
render	Operator
replace_regex	String function
reverse	String function
round	Mathematical function
row_cumsum	Window function
row_number	Window function
row_rank_dense	Window function
row_rank_min	Window function
row_window_session	Window function
search	Operator
send	Operator
set	Statement
.show objects	Command
.show options	Command
.show queries	Command
sign	Mathematical function
sin	Mathematical function
sort	Operator
split	String function
sqrt	Mathematical function
startofday	DateTime function
startofmonth	DateTime function
startofweek	DateTime function
startofyear	DateTime function
startswith	Operator
!startswith	Operator
startswith_cs	Operator
!startswith_cs	Operator
stdev	Statistical function
stdevif	Statistical function
stdevp	Statistical function
strcat	String function
strcat_delim	String function
strcmp	String function
strftime	DateTime function
string	Type
strlen	String function
strptime	DateTime function
strrep	String function
substring	String function
sum	Statistical function
sumif	Statistical function
summarize	Operator
sumsq	Cribl function
sumsqif	Cribl function
take	Operator
tan	Mathematical function
timespan	Type
timestats	Operator
to_binary_string	Binary function
tobool	Conversion function
todatetime	DateTime function
todecimal	Conversion function
todouble	Conversion function
toint	Conversion function
tolong	Conversion function
tolower	String function
top	Operator
top-hitters	Operator
toreal	Conversion function
tostring	Conversion function
totimespan	DateTime function
toupper	String function
translate	String function
trim	String function
trim_end	String function
trim_start	String function
union	Operator
unixtime_microseconds_todatetime	DateTime function
unixtime_milliseconds_todatetime	DateTime function
unixtime_nanoseconds_todatetime	DateTime function
unixtime_seconds_todatetime	DateTime function
url_decode	String function
url_encode	String function
values	Cribl function
variance	Statistical function
varianceif	Statistical function
variancep	Statistical function
$vt_dataset_providers	Virtual table
$vt_datasets	Virtual table
$vt_dummy	Virtual table
$vt_jobs	Virtual table
$vt_list	Virtual table
$vt_lookups	Virtual table
$vt_results	Virtual table
week_of_year	DateTime function
where	Operator
zip	Dynamic function

Language Reference Index

Common Resources