# Miscellaneous operators

## Table of Contents

- [backshift](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#backshift)
- [base64Decode](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#base64decode)
- [base64Encode](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#base64encode)
- [compareCIDRPrefix](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#comparecidprefix)
- [concat](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#concat)
- [decToHex](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#dectohex)
- [dedup](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#dedup)
- [format](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#format)
- [formatDate](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#formatdate)
- [getCIDRPrefix](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#getcidprefix)
- [hash](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#hash)
- [hexToAscii](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#hextoascii)
- [hexToDec](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#hextodec)
- [in](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#in)
- [ipv4ToNumber](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#ipv4tonumber)
- [isBlank](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#isblank)
- [isEmpty](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#isempty)
- [isNumeric](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#isnumeric)
- [isPrivateIP](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#isprivateip)
- [isPublicIP](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#ispublicip)
- [isValidIP](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#isvalidip)
- [len](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#len)
- [luhn](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#luhn)
- [maskFromCIDR](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#maskfromcidr)
- [matches](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#matches)
- [now](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#now)
- [parseDate](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#parsedate)
- [queryEndTime](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#queryendtime)
- [queryStartTime](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#querystarttime)
- [queryTimeRange](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#querytimerange)
- [replace](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#replace)
- [substring](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#substring)
- [timeslice](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#timeslice)
- [toBytes](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#tobytes)
- [toDuration](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#toduration)
- [toFloat](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#tofloat)
- [toInt](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#toint)
- [toLowerCase](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#tolowercase)
- [toUpperCase](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#touppercase)
- [transpose](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#transpose)
- [trim](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#trim)
- [urlDecode](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#urldecode)
- [urlEncode](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/miscellaneous-operators/#urlencode)

Using these functions in the **[Advanced Search](https://docs.kloudfuse.com/platform/4.1.0/signals/logs/advanced-search/)** interface allows for relatively complex data transformations. The **Logs Query Builder** does not natively support these functions.

## Operators

### backshift

Shifts a column in a table down by the specified number.

Syntax

```none
| backshift <field>
| backshift <field> as <alias>
| backshift <field>, <number>
| backshift <field>, <number> as <alias>
```

### base64Decode

Converts a base64 string into to an ASCII/UTF-8 string.

Syntax

```none
| base64Decode(<base64String>) as <alias>
```

Example:

```none
| base64Decode("SGVsbG8gV29ybGQ=") as K
```

### base64Encode

Converts an ASCII/UTF-8 string to a base64 string.

Syntax

```none
| base64Encode(<string>) as <alias>
```

Example:

```none
| base64Encode("Hello World") as K
```

### compareCIDRPrefix

Checks if the network prefixes of two IPv4 addresses match.

Syntax

```none
| compareCIDRPrefix(<ipv4String>, <ipv4String>) as <alias>
```

Example:

```none
| compareCIDRPrefix("10.10.1.35", "10.10.1.35", 24) as K
```

### concat

Concatenates multiple strings and numbers into a new string.

Syntax

```none
| concat(<field1>, <field2>, ...) as <alias>
```

Example:

```none
| concat("Hello", " ", "World", " ", 1) as K
```

### decToHex

Converts long value to hexadecimal value.

Syntax

```none
| decToHex(<longField>) as <alias>
```

Example:

```none
| decToHex("70") as K
```

### dedup

Removes duplicate results in a table by a set of columns.

Syntax

```none
| dedup by <field1>, <field2>, ...
| dedup by <number> <field1>, <field2>, ...
```

### format

Returns a formatted string given a format specifier and arguments.

Syntax

```none
| format(<formatSpecifierString>, <field1>, ...) as <alias>
```

Example:

```none
| format("%s : %s", "The count is", 1) as K
```

### formatDate

Returns a date string given a date, format, and timezone (default UTC).

Syntax

```none
| formatDate(<dateMilliseconds>) as <alias>
| formatDate(<dateMilliseconds>, <formatString>) as <alias>
| formatDate(<dateMilliseconds>, <formatString>, <timezoneString>) as <alias>
```

Example:

```none
| formatDate(1730925217838) as K
```

### getCIDRPrefix

Retrieves the network prefix from an IPv4 address.

Syntax

```none
| getCIDRPrefix(<ipv4String>) as <alias>
```

Example:

```none
| getCIDRPrefix("10.10.1.35") as K
```

### hash

Hashes data into a string value using the specified hash algorithm.

Syntax

```none
| hash(<field>) as <alias>
| hash(<field>, <hashAlgorithm>) as <alias>
```

Example:

```none
| hash("hello world") as K
```

### hexToAscii

Converts hexadecimal string to ASCII value.

Syntax

```none
| hexToAscii(<hexString>) as <alias>
```

Example:

```none
| hexToAscii("48656c6c6f20476f7068657221") as K
```

### hexToDec

Converts hexadecimal string to a long value.

Syntax

```none
| hexToDec(<hexString>) as <alias>
```

Example:

```none
| hexToDec("0000000000001337") as K
```

### in

Checks if a field is in a set of string values or number values.

Syntax

```none
| where <field> in (<value_1>[, <value_2>, <value_3>, ...])
```

### ipv4ToNumber

Converts an Internet Protocol version 4 (IPv4) IP address from the octet dot-decimal format to a decimal format.

Syntax

```none
| ipv4ToNumber(<ipv4String>) as <alias>
```

Example:

```none
| ipv4ToNumber("10.163.3.0") as K
```

### isBlank

Checks if a string value is null, empty, or contains only empty characters.

Syntax

```none
| isBlank(<string>) as <alias>
```

Example:

```none
| isBlank("  ") as K
```

### isEmpty

Checks if a string value is an empty string that contains no characters or whitespace.

Syntax

```none
| isEmpty(<string>) as <alias>
```

Example:

```none
| isEmpty(" a ") as K
```

### isNumeric

Checks if a string value can be parsed as a number.

Syntax

```none
| isNumeric(<string>) as <alias>
```

Example:

```none
| isNumeric("1.234") as K
```

### isPrivateIP

Checks if an IPv4 address is private.

Syntax

```none
| isPrivateIP(<ipv4String>) as <alias>
```

Example:

```none
| isPrivateIP("192.168.0.1") as K
```

### isPublicIP

Checks if an IPv4 address is public.

Syntax

```none
| isPublicIP(<ipv4String>) as <alias>
```

Example:

```none
| isPrivateIP("192.168.0.1") as K
```

### isValidIP

Checks if an IPv4 or IPv6 address is valid.

Syntax

```none
| isValidIP(<ipString>) as <alias>
```

Example:

```none
| isValidIP("192.168.0.1") as K
```

### len

Returns the length of a string.

Syntax

```none
| len(<string>) as <alias>
```

Example:

```none
| len("1234") as K
```

### luhn

Validates credit card numbers in a string value using Luhn’s algorithm.

Syntax

```none
| luhn(<string>) as <alias>
```

Example:

```none
| luhn("6666-7777-6666-8888") as K
```

### maskFromCIDR

Returns the subnet mask given a prefix length for IPv4 addresses.

Syntax

```none
| maskFromCIDR(<prefixLength>) as <alias>
```

Example:

```none
| maskFromCIDR(32) as K
```

### matches

Matches strings using the RE2-compliant regex format.

Syntax

```none
| where <string expression> matches "<regex>"
```

Example:

```none
| source="pinot-server" | parse "[*]" as class | where class matches "Server.*"
```

### now

Returns the current epoch time in milliseconds.

Syntax

```none
| now() as <alias>
```

Example:

```none
| now() as K
```

### parseDate

Parses a date string with the given format pattern and optional timezone (default UTC), and returns the corresponding epoch milliseconds.

Syntax

```none
| parseDate(<dateString>, <formatString>) as <alias>
```

Example:

```none
| parseDate("2024-11-06 20:33:37", "yyyy-MM-dd HH:mm:ss") as K
```

### queryEndTime

Returns the end time of the search in milliseconds.

Syntax

```none
| queryEndTime() as <alias>
```

Example:

```none
| queryEndTime() as K
```

### queryStartTime

Returns the start time of the search in milliseconds.

Syntax

```none
| queryStartTime() as <alias>
```

Example:

```none
| queryStartTime() as K
```

### queryTimeRange

Returns the time range for the query being executed, in milliseconds.

Syntax

```none
| queryTimeRange() as <alias>
```

Example:

```none
| queryTimeRange() as K
```

### replace

Replaces all occurrences of a specified string with another string.

Syntax

```none
| replace(<sourceString>, <searchString>, <replaceString>) as <alias>
```

Example:

```none
| replace("hello world", "world", "gopher") as K
```

### substring

Extracts a part of a given string and start/end offsets.

Syntax

```none
| substring(<sourceString>, <startOffsert>) as <alias>
```

Example:

```none
| substring("hello world", 0, 5) as K
```

### timeslice

Buckets each event’s timestamp into fixed-width time windows for use in time-series aggregation.

Syntax

```none
| timeslice <duration>
```

Example:

```none
* | timeslice 5m | count by (_timeslice)
```

### toBytes

Parses a string representation of bytes (KB, MB, GB, and so on) into the number of bytes it represents.

Syntax

```none
| toBytes(<storageSize>) as <alias>
```

Example:

```none
| toBytes("1.5KB") as K
```

### toDuration

Parses a string representation of time (ns, µs, ms, s, m, h) to milliseconds.

Syntax

```none
| toDuration(<timeString>) as <alias>
```

Example:

```none
| toDuration("2ms") as K
```

### toFloat

Parses a string representation of a number or a number to a float.

Syntax

```none
| toFloat(<number>) as <alias>
```

Example:

```none
| toFloat("1.25") as K
```

### toInt

Parses a string representation of a number, or a number to an `int`.

Syntax

```none
| toInt(<number>) as <alias>
```

Example:

```none
| toInt("1.5") as K
```

### toLowerCase

Converts all letters of a string to lowercase.

Syntax

```none
| toLowerCase(<string>) as <alias>
```

Example:

```none
| toLowerCase("HELLO WORLD") as K
```

### toUpperCase

Converts all letters of a string to uppercase.

Syntax

```none
| toUpperCase(<string>) as <alias>
```

Example:

```none
| toUpperCase("hello world") as K
```

### transpose

Converts aggregate query results from a long format into a wide, tabular format by pivoting row values into column headers.

Syntax

```none
| transpose row <row_field1>[, <row_field2>, ...] column <column_field1>[, <column_field2>, ...]
```

### trim

Removes starting and trailing empty spaces in a string.

Syntax

```none
| trim(<string>) as <alias>
```

Example:

```none
| trim("  hello world   ") as K
```

### urlDecode

Returns an unescaped URL string.

Syntax

```none
| urlDecode(<urlString>) as <alias>
```

Example:

```none
| urlDecode("http%3A%2F%2Fexample-server123.org%2Fapi%2Fv1%2Fdata.php%3Fauth%3DAbCdEfGhIjKlMnOpQrStUvWxYz123456%26") as K
```

### urlEncode

Encodes a URL into the ASCII character set.

Syntax

```none
| urlEncode(<urlString>) as <alias>
```

Example:

```none
| urlEncode("http://example-server123.org/api/v1/data.php?auth=AbCdEfGhIjKlMnOpQrStUvWxYz123456&") as K
```