Version: 2.10.X

# Built-In Computation Functions

This section describes the available functions in detail. The categories and the functions within each category are alphabetical.

## Aggregation Functions​

Aggregation functions provide mechanisms for working with sets of values.

### avg​

The `avg` function returns the average of the non-null values of the of the input series of variables.

### contains​

The `contains` function returns `true` if it finds the search expression value in the list of submitted arguments. Otherwise, it returns `false`.

### count​

The `count` function returns the total number of elements in the input array, or the total number of values for a given field in all the events in the input element.

### countUnique​

The `countUnique` function counts the total number of unique elements in an input array, or the total number of unique events of the input element.

### join​

The `join` function returns a string containing all input elements joined together by the specified delimiter.

### list​

The `list` function produces a string separated by the given delimiter.

### max​

The `max` function returns the maximum value from the input series of variables.

### min​

The `min` function returns the minimum value from the input series of variables.

### nth​

The `nth` function returns the n-th value in a pattern element group.

### product​

The `product` function returns the product of the entered series of numerical values.

### stddev​

The `stddev` function returns the standard deviation of the input series of variables.

### sum​

The `sum` function returns the sum of the entered series of numerical values.

## Array Functions​

Array functions provide mechanisms for processing and evaluating the contents of arrays.

### combine​

The `combine` function combines (and optionally dedupes) the submitted array arguments into a single array. They are concatenated in the order that they are supplied to the function.

### sort​

The `sort` function sorts an array, rearranging its elements in either ascending or descending order as specified.

### unique​

The `unique` function returns an array containing the unique values of the input array.

### valueAt​

The `valueAt` function returns the value at the specified index position of the input array. It uses a 0-based index.

Note

If the input array does not have an index at the submitted index position, the function returns `null`.

## Datatype Conversions​

Datatype conversion functions provide mechanisms to convert data of a given type into a different type.

### toArray​

The `toArray` function converts a set expression to an array. Any sets of array input are automatically flattened.

### toBoolean​

The `toBoolean` function converts input to a Boolean value.

### toDateTime​

The `toDateTime` function converts the input ISO string or epoch representation of time to the Cogynt-supported Zulu time format (`yyyy-MM-ddTHH:mm:ss[.SSS]Z`).

### toEpoch​

The `toEpoch` function converts a DateTime input to an epoch representation of time.

### toFloat​

The `toFloat` function converts input to a float (floating-point decimal number).

### toIP​

The `toIP` function converts a string to an IP.

### toInteger​

The `toInteger` function converts input to an integer.

### toString​

The `toString` function converts input to a string.

### toURL​

The `toURL` function converts input to a URL.

## Date and Time Functions​

Date functions provide mechanisms for processing and transforming dates and times.

The `dateAdd` function adds the given amount of time to the provided date and returns a new date. The timezone is not affected.

### dateDiff​

The `dateDiff` function computes the absolute difference between two dates.

### datePart​

The `datePart` function returns an integer representing the specified date part.

### dateTruncate​

The `dateTruncate` function returns the date after truncating up to and including the given granularity.

### now​

The `now` function returns the current GMT date and time with millisecond precision.

### toLocalTime​

The `toLocalTime` function converts the given date and time to the local timezone.

### toTimeZone​

The `toTimeZone` function converts the given date and time to the date and time in the specified timezone.

## IP Functions​

IP functions provide tools for evaluating and processing IPs and their constituent parts.

Note

Any `cidr` argument in an IP function should have a value between `1` and `32`.

### getHost​

The `getHost` function returns the host port of the specified IP as an IP. The network port lists zero. The CIDR value does not change.

### getNetwork​

The `getNetwork` function returns the network portion of the specified IP as an IP. The host port is zeroed out. If the CIDR argument is valid and non-null, and its value is less than the CIDR in the IP, then the argument CIDR is used. The CIDR used to get the network is the CIDR of the returned IP.

### inNetwork​

The `inNetwork` function checks whether the first IP is in the same network as the second IP (the network IP).

It takes an optional IPv4 CIDR value (ip4cidr) and IPv6 CIDR value (ip6cidr). If the provided CIDR is greater than the CIDR of the network, then the default CIDR is used. The default IPv4 CIDR is `8`, and the default IPv6 CIDR is `12`. The range for the IPv4 CIDR is 0-32, and the range for the IPv6 CIDR is 0-128. A value of `null`, `0`, or `<0` means use the CIDR in the IP.

## Math Functions​

Math functions provide means for performing complex mathematical calculations.

### abs​

The `abs` function returns the absolute value of the given value.

### ln​

The `ln` function returns the natural log of the given value.

### log10​

The `log10` function returns the common log of the given value.

### power​

The `power` function calculates exponential values by taking an entered value and raising it to the specified power.

### random​

The `random` function returns a random integer.

### round​

The `round` function rounds an entered float (floating point number) to the specified number of places.

### sqrt​

The `sqrt` function returns the square root of the entered value.

Note

The input must be positive. Otherwise, the `sqrt` function returns an error.

## Miscellaneous​

Miscellaneous functions do not fit under any of the other categories, but still provide useful mechanisms for creating and processing information.

### firstNonNull​

The `firstNonNull` function evaluates the given expressions from left to right, and returns the first non-null value.

### getSystemConfidence​

The `getSystemConfidence` function returns the system-computed confidence for the given solution. If risk computation is not enabled for the template, the functions returns a null value.

### getUrlPart​

The `getUrlPart` function returns the part of the specified URL that corresponds to the provided part string.

### lexiconMatch​

The `lexiconMatch` function returns an array of matching lexicon entries if the given expression matches the lexicon. Otherwise, it returns a null value.

### makeUrl​

The `makeUrl` function generates a URL based on the input parameters.

### randomUuid​

The `randomUuid` function generates a unique ID.

### when​

The `when` function evaluates a defined expression based on the truth or falsity of the submitted argument. When the argument is nonzero or `true`, it evaluates and returns the `true` expression. Otherwise, it evaluates and returns the `false` expression.

## Spatial Functions​

Spatial functions help process and evaluate geometrical and geographical data.

### distance​

The `distance` function returns the distance between two geo points using the selected output units.

### geoContains​

The `geoContains` function returns `true` if the specified polygon contains the specific point.

### makeGeoPoint​

The `makeGeoPoint` function converts the two submitted numbers into a single geo point.

## String Functions​

String functions provide mechanisms for creating, transforming, and working with strings.

### left​

The `left` function returns the specified number of characters from the left of the entered string.

Note

If the value of the specified integer exceeds the length of the string, then `left` returns the complete string.

### length​

The `length` function returns the length of the specified string.

### lower​

The `lower` function returns the lowercase form of the submitted string, using the default locale.

### replaceAll​

The `replaceAll` function replaces all occurrences of a given regular expression (regex) in a given string with the specified replacement string.

### replaceFirst​

The `replaceFirst` function replaces the first occurrence of a given regular expression (regex) in a given string with the specified replacement string.

The `right` function returns the specified number of characters from the right of the entered string.

Note

If the value of the specified integer exceeds the length of the string, then `right` returns the complete string.

### substring​

The `substring` function returns a substring from an input string, beginning with the submitted starting index and continuing to the specified length.

### trim​

The `trim` function removes leading and trailing spaces from the submitted string.

### upper​

The `upper` function returns the uppercase form of the submitted string, using the default locale.

Did you find the information that you needed?