> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/functions-list.md). # Functions list The following table lists all available XQL functions: | Function | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | [`acos`](/xql-command-reference-guide/readme/functions/acos.md) | Calculate the inverse cosine (arccosine) of a numerical expression | | [`add`](/xql-command-reference-guide/readme/functions/add.md) | Calculate the sum of two numbers | | [`approx_count`](/xql-command-reference-guide/readme/functions/approx_count.md) | Return an approximate count of distinct values | | [`approx_quantiles`](/xql-command-reference-guide/readme/functions/approx_quantiles.md) | Return approximate quantile boundaries | | [`approx_top`](/xql-command-reference-guide/readme/functions/approx_top.md) | Return the approximate top values | | [`asin`](/xql-command-reference-guide/readme/functions/asin.md) | Calculate the inverse sine (arcsine) of a numerical expression | | [`array_all`](/xql-command-reference-guide/readme/functions/array_all.md) | Check if all elements in an array match a condition | | [`array_any`](/xql-command-reference-guide/readme/functions/array_any.md) | Check if any element in an array matches a condition | | [`array_length`](/xql-command-reference-guide/readme/functions/array_length.md) | Return the number of elements in an array | | [`arrayconcat`](/xql-command-reference-guide/readme/functions/arrayconcat.md) | Concatenate two arrays | | [`arraycreate`](/xql-command-reference-guide/readme/functions/arraycreate.md) | Create an array from a list of values | | [`arraydistinct`](/xql-command-reference-guide/readme/functions/arraydistinct.md) | Return an array with duplicate values removed | | [`arrayfilter`](/xql-command-reference-guide/readme/functions/arrayfilter.md) | Filter elements of an array based on a condition | | [`arrayindex`](/xql-command-reference-guide/readme/functions/arrayindex.md) | Return the element at a specified index in an array | | [`arrayindexof`](/xql-command-reference-guide/readme/functions/arrayindexof.md) | Return the index of a value in an array | | [`arraymap`](/xql-command-reference-guide/readme/functions/arraymap.md) | Apply a function to each element of an array | | [`arraymerge`](/xql-command-reference-guide/readme/functions/arraymerge.md) | Merge multiple arrays into one | | [`arrayrange`](/xql-command-reference-guide/readme/functions/arrayrange.md) | Create an array of sequential integers | | [`arraystring`](/xql-command-reference-guide/readme/functions/arraystring.md) | Convert an array to a string | | [`avg` (with comp stage)](/xql-command-reference-guide/readme/functions/avg_with_comp_stage.md) | Calculate the average value using the comp stage | | [`avg` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/avg_with_windowcomp_stage.md) | Calculate the average value using the windowcomp stage | | [`bitwise_and`](/xql-command-reference-guide/readme/functions/bitwise_and.md) | Perform a bitwise AND operation between two integer values | | [`bitwise_or`](/xql-command-reference-guide/readme/functions/bitwise_or.md) | Perform a bitwise OR operation between two integer values | | [`bitwise_sleft`](/xql-command-reference-guide/readme/functions/bitwise_sleft.md) | Perform a bitwise left shift operation on an integer value | | [`bitwise_sright`](/xql-command-reference-guide/readme/functions/bitwise_sright.md) | Perform a bitwise right shift operation on an integer value | | [`bitwise_xor`](/xql-command-reference-guide/readme/functions/bitwise_xor.md) | Perform a bitwise exclusive OR (XOR) operation between two integer values | | [`cbrt`](/xql-command-reference-guide/readme/functions/cbrt.md) | Calculate the cube root of a numeric value | | [`ceil`](/xql-command-reference-guide/readme/functions/ceil.md) | Round a number up to the nearest integer | | [`coalesce`](/xql-command-reference-guide/readme/functions/coalesce.md) | Return the first non-null value from a list | | [`concat`](/xql-command-reference-guide/readme/functions/concat.md) | Concatenate two or more strings | | [`convert_from_base_64`](/xql-command-reference-guide/readme/functions/convert_from_base_64.md) | Decode a Base64-encoded string | | [`convert_to_base_64`](/xql-command-reference-guide/readme/functions/convert_to_base_64.md) | Encode a string to Base64 | | [`cos`](/xql-command-reference-guide/readme/functions/cos.md) | Calculate the cosine of a numeric value specified in radians | | [`cosine_distance`](/xql-command-reference-guide/readme/functions/cosine_distance.md) | Calculate the cosine distance between two numeric vectors | | [`cot`](/xql-command-reference-guide/readme/functions/cot.md) | Calculate the cotangent of a numeric value specified in radians | | [`count` (with comp stage)](/xql-command-reference-guide/readme/functions/count_with_comp_stage.md) | Count values using the comp stage | | [`count` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/count_with_windowcomp_stage.md) | Count values using the windowcomp stage | | [`count_distinct`](/xql-command-reference-guide/readme/functions/count_distinct.md) | Count distinct values | | [`csc`](/xql-command-reference-guide/readme/functions/csc.md) | Calculate the cosecant of a numeric value specified in radians | | [`current_time`](/xql-command-reference-guide/readme/functions/current_time.md) | Return the current timestamp | | [`date_floor`](/xql-command-reference-guide/readme/functions/date_floor.md) | Round a timestamp down to a specified time unit | | [`divide`](/xql-command-reference-guide/readme/functions/divide.md) | Divide one number by another | | [`earliest`](/xql-command-reference-guide/readme/functions/earliest.md) | Return the earliest timestamp value | | [`euclidean_distance`](/xql-command-reference-guide/readme/functions/euclidean_distance.md) | Calculate the Euclidean distance between two numeric vectors | | [`exp`](/xql-command-reference-guide/readme/functions/exp.md) | Calculate the value of e raised to the power of a numeric value | | [`extract_time`](/xql-command-reference-guide/readme/functions/extract_time.md) | Extract a time component from a timestamp | | [`extract_url_host`](/xql-command-reference-guide/readme/functions/extract_url_host.md) | Extract the host from a URL | | [`extract_url_pub_suffix`](/xql-command-reference-guide/readme/functions/extract_url_pub_suffix.md) | Extract the public suffix from a URL | | [`extract_url_registered_domain`](/xql-command-reference-guide/readme/functions/extract_url_registered_domain.md) | Extract the registered domain from a URL | | [`first`](/xql-command-reference-guide/readme/functions/first.md) | Return the first value in a group | | [`first_value`](/xql-command-reference-guide/readme/functions/first_value.md) | Return the first value in a window | | [`floor`](/xql-command-reference-guide/readme/functions/floor.md) | Round a number down to the nearest integer | | [`format_string`](/xql-command-reference-guide/readme/functions/format_string.md) | Format a string using a template | | [`format_timestamp`](/xql-command-reference-guide/readme/functions/format_timestamp.md) | Format a timestamp as a string | | [`greatest`](/xql-command-reference-guide/readme/functions/greatest.md) | Return the largest value from a list of expressions | | [`hierarchy_match`](/xql-command-reference-guide/readme/functions/hierarchy_match.md) | Check whether an asset belongs to an organizational hierarchy node | | [`if`](/xql-command-reference-guide/readme/functions/if.md) | Return one of two values based on a condition | | [`incidr`](/xql-command-reference-guide/readme/functions/incidr.md) | Check if an IPv4 address is within a CIDR range | | [`incidr6`](/xql-command-reference-guide/readme/functions/incidr6.md) | Check if an IPv6 address is within a CIDR range | | [`incidrlist`](/xql-command-reference-guide/readme/functions/incidrlist.md) | Check if an IP address is within a list of CIDR ranges | | [`int_to_ip`](/xql-command-reference-guide/readme/functions/int_to_ip.md) | Convert an integer to an IP address string | | [`ip_to_int`](/xql-command-reference-guide/readme/functions/ip_to_int.md) | Convert an IP address string to an integer | | [`is_ipv4`](/xql-command-reference-guide/readme/functions/is_ipv4.md) | Check if a value is a valid IPv4 address | | [`is_ipv6`](/xql-command-reference-guide/readme/functions/is_ipv6.md) | Check if a value is a valid IPv6 address | | [`is_known_private_ipv4`](/xql-command-reference-guide/readme/functions/is_known_private_ipv4.md) | Check if an IPv4 address is a known private address | | [`is_known_private_ipv6`](/xql-command-reference-guide/readme/functions/is_known_private_ipv6.md) | Check if an IPv6 address is a known private address | | [`json_extract`](/xql-command-reference-guide/readme/functions/json_extract.md) | Extract a value from a JSON string | | [`json_extract_array`](/xql-command-reference-guide/readme/functions/json_extract_array.md) | Extract an array from a JSON string | | [`json_extract_scalar`](/xql-command-reference-guide/readme/functions/json_extract_scalar.md) | Extract a scalar value from a JSON string | | [`json_extract_scalar_array`](/xql-command-reference-guide/readme/functions/json_extract_scalar_array.md) | Extract a scalar array from a JSON string | | [`json_path_extract`](/xql-command-reference-guide/readme/functions/json_path_extract.md) | Extract a value from a JSON string using a JSONPath expression | | [`json_functions_reference`](/xql-command-reference-guide/readme/functions/json_functions_reference.md) | Decide which JSON functions to use | | [`lag`](/xql-command-reference-guide/readme/functions/lag.md) | Return the value of a field from a previous row in a window | | [`last`](/xql-command-reference-guide/readme/functions/last.md) | Return the last value in a group | | [`last_value`](/xql-command-reference-guide/readme/functions/last_value.md) | Return the last value in a window | | [`latest`](/xql-command-reference-guide/readme/functions/latest.md) | Return the latest timestamp value | | [`least`](/xql-command-reference-guide/readme/functions/least.md) | Return the smallest value from a list of expressions | | [`len`](/xql-command-reference-guide/readme/functions/len.md) | Return the length of a string or array | | [`list` (with comp stage)](/xql-command-reference-guide/readme/functions/list_with_comp_stage.md) | Collect all values of a field and return them as an array within the comp stage | | [`ln`](/xql-command-reference-guide/readme/functions/ln.md) | Calculate the natural logarithm (base e) of a numeric value | | [`log`](/xql-command-reference-guide/readme/functions/log.md) | Calculate the logarithm of a numeric value with a specified base | | [`log10`](/xql-command-reference-guide/readme/functions/log10.md) | Calculate the base-10 logarithm of a numeric value | | [`lowercase`](/xql-command-reference-guide/readme/functions/lowercase.md) | Convert a string to lowercase | | [`ltrim`](/xql-command-reference-guide/readme/functions/ltrim.md) | Remove leading whitespace from a string | | [`max` (with comp stage)](/xql-command-reference-guide/readme/functions/max_with_comp_stage.md) | Return the maximum value of a field within the comp stage | | [`max` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/max_with_windowcomp_stage.md) | Compute the maximum value of a field over a window of rows within the windowcomp stage | | [`md5`](/xql-command-reference-guide/readme/functions/md5.md) | Calculate the MD5 hash of a string | | [`median` (with comp stage)](/xql-command-reference-guide/readme/functions/median_with_comp_stage.md) | Return the median value of a numeric field within the comp stage | | [`median` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/median_with_windowcomp_stage.md) | Compute the median value of a numeric field over a window of rows within the windowcomp stage | | [`min` (with comp stage)](/xql-command-reference-guide/readme/functions/min_with_comp_stage.md) | Return the minimum value of a field within the comp stage | | [`min` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/min_with_windowcomp_stage.md) | Compute the minimum value of a field over a window of rows within the windowcomp stage | | [`mod`](/xql-command-reference-guide/readme/functions/mod.md) | Calculate the remainder (modulus) of the division of two numeric values | | [`multiply`](/xql-command-reference-guide/readme/functions/multiply.md) | Multiply two numbers | | [`object_create`](/xql-command-reference-guide/readme/functions/object_create.md) | Create a JSON object from key-value pairs | | [`object_merge`](/xql-command-reference-guide/readme/functions/object_merge.md) | Merge two JSON objects | | [`parse_epoch`](/xql-command-reference-guide/readme/functions/parse_epoch.md) | Parse an epoch timestamp | | [`parse_timestamp`](/xql-command-reference-guide/readme/functions/parse_timestamp.md) | Parse a timestamp string | | [`pow`](/xql-command-reference-guide/readme/functions/pow.md) | Raise a number to a power | | [`power`](/xql-command-reference-guide/readme/functions/power.md) | Raise a number to the power of another number (alias for pow) | | [`rand`](/xql-command-reference-guide/readme/functions/rand.md) | Generate a pseudo-random floating-point number between 0 and 1 | | [`range_bucket`](/xql-command-reference-guide/readme/functions/range_bucket.md) | Determine which bucket a numeric value falls into given an array of boundaries | | [`rank` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/rank_with_windowcomp_stage.md) | Assign a rank to each row within a partition in the windowcomp stage | | [`regexcapture`](/xql-command-reference-guide/readme/functions/regexcapture.md) | Extract substrings using a regular expression | | [`regextract`](/xql-command-reference-guide/readme/functions/regextract.md) | Extract a substring from a field value using a regular expression pattern | | [`replace`](/xql-command-reference-guide/readme/functions/replace.md) | Replace occurrences of a substring | | [`replex`](/xql-command-reference-guide/readme/functions/replex.md) | Replace substrings using a regular expression | | [`round`](/xql-command-reference-guide/readme/functions/round.md) | Round a number to a specified number of decimal places | | [`row_number` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/row_number_with_windowcomp_stage.md) | Assign a unique sequential integer to each row within a partition in the windowcomp stage | | [`rtrim`](/xql-command-reference-guide/readme/functions/rtrim.md) | Remove trailing whitespace from a string | | [`safe_add`](/xql-command-reference-guide/readme/functions/safe_add.md) | Perform addition with overflow protection, returning null on overflow | | [`safe_divide`](/xql-command-reference-guide/readme/functions/safe_divide.md) | Perform division with error protection, returning null on division by zero | | [`safe_multiply`](/xql-command-reference-guide/readme/functions/safe_multiply.md) | Perform multiplication with overflow protection, returning null on overflow | | [`safe_negate`](/xql-command-reference-guide/readme/functions/safe_negate.md) | Negate a numeric value with overflow protection, returning null on overflow | | [`safe_subtract`](/xql-command-reference-guide/readme/functions/safe_subtract.md) | Perform subtraction with overflow protection, returning null on overflow | | [`sec`](/xql-command-reference-guide/readme/functions/sec.md) | Calculate the secant of a numeric value specified in radians | | [`sha1`](/xql-command-reference-guide/readme/functions/sha1.md) | Calculate the SHA-1 hash of a string | | [`sha256`](/xql-command-reference-guide/readme/functions/sha256.md) | Calculate the SHA-256 hash of a string | | [`sha512`](/xql-command-reference-guide/readme/functions/sha512.md) | Calculate the SHA-512 hash of a string | | [`sign`](/xql-command-reference-guide/readme/functions/sign.md) | Determine the sign of a numeric value (-1, 0, or 1) | | [`sin`](/xql-command-reference-guide/readme/functions/sin.md) | Calculate the sine of a numeric value specified in radians | | [`split`](/xql-command-reference-guide/readme/functions/split.md) | Split a string into an array | | [`sqrt`](/xql-command-reference-guide/readme/functions/sqrt.md) | Calculate the square root of a numeric value | | [`stddev_population` (with comp stage)](/xql-command-reference-guide/readme/functions/stddev_population_with_comp_stage.md) | Compute the population standard deviation of a numeric field within the comp stage | | [`stddev_population` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/stddev_population_with_windowcomp_stage.md) | Compute the population standard deviation of a numeric field over a window of rows within the windowcomp stage | | [`stddev_sample` (with comp stage)](/xql-command-reference-guide/readme/functions/stddev_sample_with_comp_stage.md) | Compute the sample standard deviation of a numeric field within the comp stage | | [`stddev_sample` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/stddev_sample_with_windowcomp_stage.md) | Compute the sample standard deviation of a numeric field over a window of rows within the windowcomp stage | | [`string_count`](/xql-command-reference-guide/readme/functions/string_count.md) | Count occurrences of a substring in a string | | [`subtract`](/xql-command-reference-guide/readme/functions/subtract.md) | Subtract one number from another | | [`sum` (with comp stage)](/xql-command-reference-guide/readme/functions/sum_with_comp_stage.md) | Compute the sum of a numeric field within the comp stage | | [`sum` (with windowcomp stage)](/xql-command-reference-guide/readme/functions/sum_with_windowcomp_stage.md) | Compute the sum of a numeric field over a window of rows within the windowcomp stage | | [`tan`](/xql-command-reference-guide/readme/functions/tan.md) | Calculate the tangent of a numeric value specified in radians | | [`time_frame_end`](/xql-command-reference-guide/readme/functions/time_frame_end.md) | Return the end of a time frame | | [`timestamp_diff`](/xql-command-reference-guide/readme/functions/timestamp_diff.md) | Calculate the difference between two timestamps | | [`timestamp_seconds`](/xql-command-reference-guide/readme/functions/timestamp_seconds.md) | Convert a timestamp to seconds | | [`to_boolean`](/xql-command-reference-guide/readme/functions/to_boolean.md) | Convert a value to a boolean | | [`to_epoch`](/xql-command-reference-guide/readme/functions/to_epoch.md) | Convert a timestamp to an epoch value | | [`to_float`](/xql-command-reference-guide/readme/functions/to_float.md) | Convert a value to a float | | [`to_integer`](/xql-command-reference-guide/readme/functions/to_integer.md) | Convert a value to an integer | | [`to_json_string`](/xql-command-reference-guide/readme/functions/to_json_string.md) | Convert a value to a JSON string | | [`to_number`](/xql-command-reference-guide/readme/functions/to_number.md) | Convert a value to a number | | [`to_string`](/xql-command-reference-guide/readme/functions/to_string.md) | Convert a value to a string | | [`to_timestamp`](/xql-command-reference-guide/readme/functions/to_timestamp.md) | Convert a value to a timestamp | | [`trim`](/xql-command-reference-guide/readme/functions/trim.md) | Remove leading and trailing whitespace from a string | | [`trunc`](/xql-command-reference-guide/readme/functions/trunc.md) | Truncate a numeric value to a specified number of decimal places | | [`uppercase`](/xql-command-reference-guide/readme/functions/uppercase.md) | Convert a string to uppercase | | [`values`](/xql-command-reference-guide/readme/functions/values.md) | Collect all distinct values of a field and return them as an array within the comp stage | | [`var`](/xql-command-reference-guide/readme/functions/var.md) | Compute the variance of a numeric field within the comp stage | | [`wildcard_match`](/xql-command-reference-guide/readme/functions/wildcard_match.md) | Check if a string matches a wildcard pattern | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/functions-list.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.