Logship Documentation
Open Logship
  • Prerequisites
  • Single Node Deployment
  • Push Your First Event
  • Query
  • Advanced
  • Next Steps
  • Logship Database
  • Install
  • Database Configuration
  • Blob storage durability
  • Identity providers and SSO
  • Indexed file V5 encodings
  • Table declarations and blob references
  • Logship Agent
  • Getting Started
  • Install
  • Config
  • Platform Guides
    • Agent installation on openwrt
  • Overview
  • Install logsh
  • Terminal UI (logsht)
  • Overview
  • Install
  • Frontend Configuration
  • System Settings
  • Account Settings
  • Grafana Datasource Plugin
  • Dashboards
  • Public query embeds
  • Operations
  • Administration Account
  • Incident Management
  • Group Management
  • Security
    • Firewall & Network Hardening
    • Token revocation
  • Basics
  • Language
    • Functions
      • Aggregate Functions
        • Agg Avg
        • Agg Expavg
        • Agg Max
        • Agg Min
        • Argmax
        • Argmin
        • Avg
        • Count
        • Dcount
        • First
        • Join
        • Make List
        • Make Set
        • Percentile
        • percentiles
        • Stdev
        • Sum
        • Variance
      • Scalar Functions
        • Abs
        • Acos
        • Acos2
        • Ago
        • Asin
        • Asin2
        • Atan
        • Atan2
        • Bin
        • Case
        • Ceil
        • Coalesce
        • Concat
        • Cos
        • Countof
        • Datetime Add
        • Datetime Diff
        • Datetime Part
        • Datetime Utc To Local
        • Degrees
        • Exp
        • Extract
        • Floor
        • Format Datetime
        • Hash
        • Iff
        • Indexof
        • Isempty
        • Isnotempty
        • Isnull
        • Json
        • Log
        • Log10
        • Log2
        • Math
        • Max
        • Min
        • Newid
        • Now
        • Parse Json
        • Pi
        • Pow
        • Prev
        • Radians
        • Rand
        • Round
        • Sign
        • Sin
        • Split
        • Sqrt
        • Str
        • String Transform
        • Strlen
        • Substring
        • Tan
        • Todouble
        • Toguid
        • Toint
        • Toreal
        • Tostring
        • Trim
        • Trim End
        • Trim Start
        • Type Conversion
    • Management Commands
      • .create table
      • .create-merge table
      • .drop column
      • .drop table
      • .show table
      • .show tables
      • .truncate table
      • Table retention policy
    • Tabular Operators
      • Count
      • Datatable
      • Distinct
      • Extend
      • Join
      • Limit
      • Make-Streams
      • multi-project
      • Parse
      • Project
      • Range
      • Render
      • Sort
      • Summarize
      • Table
      • Take
      • Time-Bound
      • Union
      • Where Filter
    • Chart settings reference
    • Expressions
    • Types
  • Multiple query results
  • Query

Functions

Functions calculate values within query expressions. Scalar functions operate on individual values, while aggregate functions combine values across rows, usually in a summarize expression. Choose the group that matches your calculation, then consult the function reference for arguments and examples.

Sections

Aggregate Functions

Aggregate functions reduce a set of rows to summary values such as counts, totals, averages, or percentiles. Use them with summarize to calculate results across a whole dataset or separately for each group. Each page explains the inputs and the result produced by the function.

Scalar Functions

Scalar functions transform or calculate individual values in a query. Use them for string processing, date and time arithmetic, numeric calculations, null handling, and type conversion. They can appear in expressions such as filters, projected columns, and grouping keys.