Language
Build queries as pipelines: start from a table or generated data, filter and shape rows, then aggregate, join, or render the results. Use Tabular Operators for pipeline stages, Functions for expressions and calculations, and Types and Expressions for the underlying syntax. Management Commands describe operations that inspect or change table definitions.
Sections
Functions
Functions calculate values within query expressions. Scalar functions operate on individual values, while aggregate functions combine values across rows, usually in a summarize expression. Choose the group that matches your calculation, then consult the function reference for arguments and examples.
Management Commands
Management commands inspect or change table definitions rather than transform a stream of query results. Use the show commands to inspect tables and columns, create commands to declare or extend a table's schema, and drop to remove a table. Review the permissions and behavior documented for each command before using it.
Tabular Operators
Tabular operators transform a stream of rows and are combined with the pipe character. Use them to select columns, filter events, join datasets, aggregate values, and choose how results are rendered. Each reference page describes the operator's syntax and includes an example.