# Functions

Functions appear in [expressions](https://preview.docs.tenzir.com/375/375/reference/expressions.md) and take positional and/or named arguments, producing a value as a result of their computation.

Function signatures have the following notation:

```tql
f(arg1:<type>, arg2=<type>, [arg3=type]) -> <type>
```

* `arg:<type>`: positional argument
* `arg=<type>`: named argument
* `[arg=type]`: optional (named) argument
* `-> <type>`: function return type

## Aggregation

### [all](https://preview.docs.tenzir.com/375/375/reference/functions/all.md)

Computes the conjunction (AND) of all grouped boolean values.

```tql
all([true,true,false])
```

### [any](https://preview.docs.tenzir.com/375/375/reference/functions/any.md)

Computes the disjunction (OR) of all grouped boolean values.

```tql
any([true,false,true])
```

### [collect](https://preview.docs.tenzir.com/375/375/reference/functions/collect.md)

Creates a list of all non-null grouped values, preserving duplicates.

```tql
collect([1,2,2,3])
```

### [count](https://preview.docs.tenzir.com/375/375/reference/functions/count.md)

Counts the events or non-null grouped values.

```tql
count([1,2,null])
```

### [count\_distinct](https://preview.docs.tenzir.com/375/375/reference/functions/count_distinct.md)

Counts all distinct non-null grouped values.

```tql
count_distinct([1,2,2,3])
```

### [count\_if](https://preview.docs.tenzir.com/375/375/reference/functions/count_if.md)

Counts the events or non-null grouped values matching a given predicate.

```tql
count_if([1,2,null], x => x > 1)
```

### [distinct](https://preview.docs.tenzir.com/375/375/reference/functions/distinct.md)

Creates a sorted list without duplicates of non-null grouped values.

```tql
distinct([1,2,2,3])
```

### [entropy](https://preview.docs.tenzir.com/375/375/reference/functions/entropy.md)

Computes the Shannon entropy of all grouped values.

```tql
entropy([1,1,2,3])
```

### [first](https://preview.docs.tenzir.com/375/375/reference/functions/first.md)

Takes the first non-null grouped value.

```tql
first([null,2,3])
```

### [last](https://preview.docs.tenzir.com/375/375/reference/functions/last.md)

Takes the last non-null grouped value.

```tql
last([1,2,null])
```

### [max](https://preview.docs.tenzir.com/375/375/reference/functions/max.md)

Computes the maximum of all grouped values.

```tql
max([1,2,3])
```

### [mean](https://preview.docs.tenzir.com/375/375/reference/functions/mean.md)

Computes the mean of all grouped values.

```tql
mean([1,2,3])
```

### [median](https://preview.docs.tenzir.com/375/375/reference/functions/median.md)

Computes the approximate median of all grouped values using a t-digest algorithm.

```tql
median([1,2,3,4])
```

### [min](https://preview.docs.tenzir.com/375/375/reference/functions/min.md)

Computes the minimum of all grouped values.

```tql
min([1,2,3])
```

### [mode](https://preview.docs.tenzir.com/375/375/reference/functions/mode.md)

Takes the most common non-null grouped value.

```tql
mode([1,1,2,3])
```

### [otherwise](https://preview.docs.tenzir.com/375/375/reference/functions/otherwise.md)

Returns a `fallback` value if `primary` is `null`.

```tql
x.otherwise(0)
```

### [quantile](https://preview.docs.tenzir.com/375/375/reference/functions/quantile.md)

Computes the specified quantile of all grouped values.

```tql
quantile([1,2,3,4], q=0.5)
```

### [stddev](https://preview.docs.tenzir.com/375/375/reference/functions/stddev.md)

Computes the standard deviation of all grouped values.

```tql
stddev([1,2,3])
```

### [sum](https://preview.docs.tenzir.com/375/375/reference/functions/sum.md)

Computes the sum of all values.

```tql
sum([1,2,3])
```

### [value\_counts](https://preview.docs.tenzir.com/375/375/reference/functions/value_counts.md)

Returns a list of all grouped values alongside their frequency.

```tql
value_counts([1,2,2,3])
```

### [variance](https://preview.docs.tenzir.com/375/375/reference/functions/variance.md)

Computes the variance of all grouped values.

```tql
variance([1,2,3])
```

## Bit Operations

### [bit\_and](https://preview.docs.tenzir.com/375/375/reference/functions/bit_and.md)

Computes the bit-wise AND of its arguments.

```tql
bit_and(lhs, rhs)
```

### [bit\_not](https://preview.docs.tenzir.com/375/375/reference/functions/bit_not.md)

Computes the bit-wise NOT of its argument.

```tql
bit_not(x)
```

### [bit\_or](https://preview.docs.tenzir.com/375/375/reference/functions/bit_or.md)

Computes the bit-wise OR of its arguments.

```tql
bit_or(lhs, rhs)
```

### [bit\_xor](https://preview.docs.tenzir.com/375/375/reference/functions/bit_xor.md)

Computes the bit-wise XOR of its arguments.

```tql
bit_xor(lhs, rhs)
```

### [shift\_left](https://preview.docs.tenzir.com/375/375/reference/functions/shift_left.md)

Performs a bit-wise left shift.

```tql
shift_left(lhs, rhs)
```

### [shift\_right](https://preview.docs.tenzir.com/375/375/reference/functions/shift_right.md)

Performs a bit-wise right shift.

```tql
shift_right(lhs, rhs)
```

## Decoding

### [decode\_base58](https://preview.docs.tenzir.com/375/375/reference/functions/decode_base58.md)

Decodes bytes as Base58.

```tql
decode_base58("JxF12TrwUP45BMd")
```

### [decode\_base64](https://preview.docs.tenzir.com/375/375/reference/functions/decode_base64.md)

Decodes bytes as Base64.

```tql
decode_base64("VGVuemly")
```

### [decode\_hex](https://preview.docs.tenzir.com/375/375/reference/functions/decode_hex.md)

Decodes bytes from their hexadecimal representation.

```tql
decode_hex("4e6f6E6365")
```

### [decode\_url](https://preview.docs.tenzir.com/375/375/reference/functions/decode_url.md)

Decodes URL encoded strings.

```tql
decode_url("Hello%20World")
```

## Encoding

### [encode\_base58](https://preview.docs.tenzir.com/375/375/reference/functions/encode_base58.md)

Encodes bytes as Base58.

```tql
encode_base58("Tenzir")
```

### [encode\_base64](https://preview.docs.tenzir.com/375/375/reference/functions/encode_base64.md)

Encodes bytes as Base64.

```tql
encode_base64("Tenzir")
```

### [encode\_hex](https://preview.docs.tenzir.com/375/375/reference/functions/encode_hex.md)

Encodes bytes into their hexadecimal representation.

```tql
encode_hex("Tenzir")
```

### [encode\_url](https://preview.docs.tenzir.com/375/375/reference/functions/encode_url.md)

Encodes strings using URL encoding.

```tql
encode_url("Hello World")
```

## Hashing

### [hash\_md5](https://preview.docs.tenzir.com/375/375/reference/functions/hash_md5.md)

Computes an MD5 hash digest.

```tql
hash_md5("foo")
```

### [hash\_sha1](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha1.md)

Computes a SHA-1 hash digest.

```tql
hash_sha1("foo")
```

### [hash\_sha224](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha224.md)

Computes a SHA-224 hash digest.

```tql
hash_sha224("foo")
```

### [hash\_sha256](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha256.md)

Computes a SHA-256 hash digest.

```tql
hash_sha256("foo")
```

### [hash\_sha3\_224](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha3_224.md)

Computes a SHA3-224 hash digest.

```tql
hash_sha3_224("foo")
```

### [hash\_sha3\_256](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha3_256.md)

Computes a SHA3-256 hash digest.

```tql
hash_sha3_256("foo")
```

### [hash\_sha3\_384](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha3_384.md)

Computes a SHA3-384 hash digest.

```tql
hash_sha3_384("foo")
```

### [hash\_sha3\_512](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha3_512.md)

Computes a SHA3-512 hash digest.

```tql
hash_sha3_512("foo")
```

### [hash\_sha384](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha384.md)

Computes a SHA-384 hash digest.

```tql
hash_sha384("foo")
```

### [hash\_sha512](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha512.md)

Computes a SHA-512 hash digest.

```tql
hash_sha512("foo")
```

### [hash\_xxh3](https://preview.docs.tenzir.com/375/375/reference/functions/hash_xxh3.md)

Computes an XXH3 hash digest.

```tql
hash_xxh3("foo")
```

## IP

### [ip\_category](https://preview.docs.tenzir.com/375/375/reference/functions/ip_category.md)

Returns the type classification of an IP address.

```tql
ip_category(8.8.8.8)
```

### [is\_global](https://preview.docs.tenzir.com/375/375/reference/functions/is_global.md)

Checks whether an IP address is a global address.

```tql
is_global(8.8.8.8)
```

### [is\_link\_local](https://preview.docs.tenzir.com/375/375/reference/functions/is_link_local.md)

Checks whether an IP address is a link-local address.

```tql
is_link_local(169.254.1.1)
```

### [is\_loopback](https://preview.docs.tenzir.com/375/375/reference/functions/is_loopback.md)

Checks whether an IP address is a loopback address.

```tql
is_loopback(127.0.0.1)
```

### [is\_multicast](https://preview.docs.tenzir.com/375/375/reference/functions/is_multicast.md)

Checks whether an IP address is a multicast address.

```tql
is_multicast(224.0.0.1)
```

### [is\_private](https://preview.docs.tenzir.com/375/375/reference/functions/is_private.md)

Checks whether an IP address is a private address.

```tql
is_private(192.168.1.1)
```

### [is\_v4](https://preview.docs.tenzir.com/375/375/reference/functions/is_v4.md)

Checks whether an IP address has version number 4.

```tql
is_v4(1.2.3.4)
```

### [is\_v6](https://preview.docs.tenzir.com/375/375/reference/functions/is_v6.md)

Checks whether an IP address has version number 6.

```tql
is_v6(::1)
```

### [network](https://preview.docs.tenzir.com/375/375/reference/functions/network.md)

Retrieves the network address of a subnet.

```tql
10.0.0.0/8.network()
```

## List

### [add](https://preview.docs.tenzir.com/375/375/reference/functions/add.md)

Adds an element into a list if it doesn't already exist (set-insertion).

```tql
xs.add(y)
```

### [append](https://preview.docs.tenzir.com/375/375/reference/functions/append.md)

Inserts an element at the back of a list.

```tql
xs.append(y)
```

### [concatenate](https://preview.docs.tenzir.com/375/375/reference/functions/concatenate.md)

Merges two lists.

```tql
concatenate(xs, ys)
```

### [get](https://preview.docs.tenzir.com/375/375/reference/functions/get.md)

Gets a field from a record or an element from a list

```tql
xs.get(index, fallback)
```

### [length](https://preview.docs.tenzir.com/375/375/reference/functions/length.md)

Retrieves the length of a list.

```tql
[1,2,3].length()
```

### [map](https://preview.docs.tenzir.com/375/375/reference/functions/map.md)

Maps each list element to an expression.

```tql
xs.map(x => x + 3)
```

### [prepend](https://preview.docs.tenzir.com/375/375/reference/functions/prepend.md)

Inserts an element at the start of a list.

```tql
xs.prepend(y)
```

### [remove](https://preview.docs.tenzir.com/375/375/reference/functions/remove.md)

Removes all occurrences of an element from a list.

```tql
xs.remove(y)
```

### [sort](https://preview.docs.tenzir.com/375/375/reference/functions/sort.md)

Sorts lists and record fields.

```tql
xs.sort()
```

### [where](https://preview.docs.tenzir.com/375/375/reference/functions/where.md)

Filters list elements based on a predicate.

```tql
xs.where(x => x > 5)
```

### [zip](https://preview.docs.tenzir.com/375/375/reference/functions/zip.md)

Combines two lists into a list of pairs.

```tql
zip(xs, ys)
```

## Math

### [abs](https://preview.docs.tenzir.com/375/375/reference/functions/abs.md)

Returns the absolute value.

```tql
abs(-42)
```

### [ceil](https://preview.docs.tenzir.com/375/375/reference/functions/ceil.md)

Computes the ceiling of a number or a time/duration with a specified unit.

```tql
ceil(4.2)
```

### [floor](https://preview.docs.tenzir.com/375/375/reference/functions/floor.md)

Computes the floor of a number or a time/duration with a specified unit.

```tql
floor(4.8)
```

### [round](https://preview.docs.tenzir.com/375/375/reference/functions/round.md)

Rounds a number or a time/duration with a specified unit.

```tql
round(4.6)
```

### [sqrt](https://preview.docs.tenzir.com/375/375/reference/functions/sqrt.md)

Computes the square root of a number.

```tql
sqrt(49)
```

## Networking

### [community\_id](https://preview.docs.tenzir.com/375/375/reference/functions/community_id.md)

Computes the Community ID for a network connection/flow.

```tql
community_id(src_ip=1.2.3.4, dst_ip=4.5.6.7, proto="tcp")
```

### [decapsulate](https://preview.docs.tenzir.com/375/375/reference/functions/decapsulate.md)

Decapsulates packet data at link, network, and transport layer.

```tql
decapsulate(this)
```

### [encrypt\_cryptopan](https://preview.docs.tenzir.com/375/375/reference/functions/encrypt_cryptopan.md)

Encrypts an IP address via Crypto-PAn.

```tql
encrypt_cryptopan(1.2.3.4)
```

## OCSF

### [ocsf::category\_name](https://preview.docs.tenzir.com/375/375/reference/functions/ocsf/category_name.md)

Returns the `category_name` for a given `category_uid`.

```tql
ocsf::category_name(2)
```

### [ocsf::category\_uid](https://preview.docs.tenzir.com/375/375/reference/functions/ocsf/category_uid.md)

Returns the `category_uid` for a given `category_name`.

```tql
ocsf::category_uid("Findings")
```

### [ocsf::class\_name](https://preview.docs.tenzir.com/375/375/reference/functions/ocsf/class_name.md)

Returns the `class_name` for a given `class_uid`.

```tql
ocsf::class_name(4003)
```

### [ocsf::class\_uid](https://preview.docs.tenzir.com/375/375/reference/functions/ocsf/class_uid.md)

Returns the `class_uid` for a given `class_name`.

```tql
ocsf::class_uid("DNS Activity")
```

### [ocsf::type\_name](https://preview.docs.tenzir.com/375/375/reference/functions/ocsf/type_name.md)

Returns the `type_name` for a given `type_uid`.

```tql
ocsf::type_name(400704)
```

### [ocsf::type\_uid](https://preview.docs.tenzir.com/375/375/reference/functions/ocsf/type_uid.md)

Returns the `type_uid` for a given `type_name`.

```tql
ocsf::type_uid("SSH Activity: Fail")
```

## Parsing

### [parse\_cef](https://preview.docs.tenzir.com/375/375/reference/functions/parse_cef.md)

Parses a string as a CEF message

```tql
string.parse_cef()
```

### [parse\_csv](https://preview.docs.tenzir.com/375/375/reference/functions/parse_csv.md)

Parses a string as CSV (Comma-Separated Values).

```tql
string.parse_csv(header=["a","b"])
```

### [parse\_grok](https://preview.docs.tenzir.com/375/375/reference/functions/parse_grok.md)

Parses a string according to a grok pattern.

```tql
string.parse_grok("%{IP:client} …")
```

### [parse\_json](https://preview.docs.tenzir.com/375/375/reference/functions/parse_json.md)

Parses a string as a JSON value.

```tql
string.parse_json()
```

### [parse\_kv](https://preview.docs.tenzir.com/375/375/reference/functions/parse_kv.md)

Parses a string as key-value pairs.

```tql
string.parse_kv()
```

### [parse\_leef](https://preview.docs.tenzir.com/375/375/reference/functions/parse_leef.md)

Parses a string as a LEEF message

```tql
string.parse_leef()
```

### [parse\_ssv](https://preview.docs.tenzir.com/375/375/reference/functions/parse_ssv.md)

Parses a string as space separated values.

```tql
string.parse_ssv(header=["a","b"])
```

### [parse\_syslog](https://preview.docs.tenzir.com/375/375/reference/functions/parse_syslog.md)

Parses a string as a Syslog message.

```tql
string.parse_syslog()
```

### [parse\_tsv](https://preview.docs.tenzir.com/375/375/reference/functions/parse_tsv.md)

Parses a string as tab separated values.

```tql
string.parse_tsv(header=["a","b"])
```

### [parse\_winlog](https://preview.docs.tenzir.com/375/375/reference/functions/parse_winlog.md)

Parses a string as a Windows Event Log XML record.

```tql
string.parse_winlog()
```

### [parse\_xml](https://preview.docs.tenzir.com/375/375/reference/functions/parse_xml.md)

Parses a string as XML and extracts elements matching an XPath expression.

```tql
string.parse_xml(xpath="//element")
```

### [parse\_xsv](https://preview.docs.tenzir.com/375/375/reference/functions/parse_xsv.md)

Parses a string as delimiter separated values.

```tql
string.parse_xsv(",", ";", "", header=["a","b"])
```

### [parse\_yaml](https://preview.docs.tenzir.com/375/375/reference/functions/parse_yaml.md)

Parses a string as a YAML value.

```tql
string.parse_yaml()
```

## Printing

### [print\_cef](https://preview.docs.tenzir.com/375/375/reference/functions/print_cef.md)

Prints records as Common Event Format (CEF) messages

```tql
extension.print_cef(cef_version="0", device_vendor="Tenzir", device_product="Tenzir Node", device_version="5.5.0", signature_id=id, name="description", severity="7")
```

### [print\_csv](https://preview.docs.tenzir.com/375/375/reference/functions/print_csv.md)

Prints a record as a comma-separated string of values.

```tql
record.print_csv()
```

### [print\_json](https://preview.docs.tenzir.com/375/375/reference/functions/print_json.md)

Transforms a value into a JSON string.

```tql
record.print_json()
```

### [print\_kv](https://preview.docs.tenzir.com/375/375/reference/functions/print_kv.md)

Prints records in a key-value format.

```tql
record.print_kv()
```

### [print\_leef](https://preview.docs.tenzir.com/375/375/reference/functions/print_leef.md)

Prints records as LEEF messages

```tql
attributes.print_leef(vendor="Tenzir",product_name="Tenzir Node", product_name="5.5.0",event_class_id=id)
```

### [print\_ndjson](https://preview.docs.tenzir.com/375/375/reference/functions/print_ndjson.md)

Transforms a value into a single-line JSON string.

```tql
record.print_ndjson()
```

### [print\_ssv](https://preview.docs.tenzir.com/375/375/reference/functions/print_ssv.md)

Prints a record as a space-separated string of values.

```tql
record.print_ssv()
```

### [print\_tsv](https://preview.docs.tenzir.com/375/375/reference/functions/print_tsv.md)

Prints a record as a tab-separated string of values.

```tql
record.print_tsv()
```

### [print\_xsv](https://preview.docs.tenzir.com/375/375/reference/functions/print_xsv.md)

Prints a record as a delimited sequence of values.

```tql
record.print_tsv()
```

### [print\_yaml](https://preview.docs.tenzir.com/375/375/reference/functions/print_yaml.md)

Prints a value as a YAML document.

```tql
record.print_yaml()
```

## Record

### [drop\_matching](https://preview.docs.tenzir.com/375/375/reference/functions/drop_matching.md)

Removes top-level fields from a record when their names match a regular expression.

```tql
record.drop_matching("^debug_")
```

### [get](https://preview.docs.tenzir.com/375/375/reference/functions/get.md)

Gets a field from a record or an element from a list

```tql
xs.get(index, fallback)
```

### [has](https://preview.docs.tenzir.com/375/375/reference/functions/has.md)

Checks whether a record has a specified field.

```tql
record.has("field")
```

### [keys](https://preview.docs.tenzir.com/375/375/reference/functions/keys.md)

Retrieves a list of field names from a record.

```tql
record.keys()
```

### [merge](https://preview.docs.tenzir.com/375/375/reference/functions/merge.md)

Combines two records into a single record by merging their fields.

```tql
merge(foo, bar)
```

### [select\_matching](https://preview.docs.tenzir.com/375/375/reference/functions/select_matching.md)

Selects top-level fields from a record when their names match a regular expression.

```tql
record.select_matching("^src_")
```

### [sort](https://preview.docs.tenzir.com/375/375/reference/functions/sort.md)

Sorts lists and record fields.

```tql
xs.sort()
```

## Runtime

### [config](https://preview.docs.tenzir.com/375/375/reference/functions/config.md)

Reads Tenzir's configuration file.

```tql
config()
```

### [env](https://preview.docs.tenzir.com/375/375/reference/functions/env.md)

Reads an environment variable.

```tql
env("PATH")
```

### [secret](https://preview.docs.tenzir.com/375/375/reference/functions/secret.md)

Use the value of a secret.

```tql
secret("KEY")
```

## Subnet

### [network](https://preview.docs.tenzir.com/375/375/reference/functions/network.md)

Retrieves the network address of a subnet.

```tql
10.0.0.0/8.network()
```

## Time & Date

### [count\_days](https://preview.docs.tenzir.com/375/375/reference/functions/count_days.md)

Counts the number of `days` in a duration.

```tql
count_days(100d)
```

### [count\_hours](https://preview.docs.tenzir.com/375/375/reference/functions/count_hours.md)

Counts the number of `hours` in a duration.

```tql
count_hours(100d)
```

### [count\_microseconds](https://preview.docs.tenzir.com/375/375/reference/functions/count_microseconds.md)

Counts the number of `microseconds` in a duration.

```tql
count_microseconds(100d)
```

### [count\_milliseconds](https://preview.docs.tenzir.com/375/375/reference/functions/count_milliseconds.md)

Counts the number of `milliseconds` in a duration.

```tql
count_milliseconds(100d)
```

### [count\_minutes](https://preview.docs.tenzir.com/375/375/reference/functions/count_minutes.md)

Counts the number of `minutes` in a duration.

```tql
count_minutes(100d)
```

### [count\_months](https://preview.docs.tenzir.com/375/375/reference/functions/count_months.md)

Counts the number of `months` in a duration.

```tql
count_months(100d)
```

### [count\_nanoseconds](https://preview.docs.tenzir.com/375/375/reference/functions/count_nanoseconds.md)

Counts the number of `nanoseconds` in a duration.

```tql
count_nanoseconds(100d)
```

### [count\_seconds](https://preview.docs.tenzir.com/375/375/reference/functions/count_seconds.md)

Counts the number of `seconds` in a duration.

```tql
count_seconds(100d)
```

### [count\_weeks](https://preview.docs.tenzir.com/375/375/reference/functions/count_weeks.md)

Counts the number of `weeks` in a duration.

```tql
count_weeks(100d)
```

### [count\_years](https://preview.docs.tenzir.com/375/375/reference/functions/count_years.md)

Counts the number of `years` in a duration.

```tql
count_years(100d)
```

### [day](https://preview.docs.tenzir.com/375/375/reference/functions/day.md)

Extracts the day component from a timestamp.

```tql
ts.day()
```

### [days](https://preview.docs.tenzir.com/375/375/reference/functions/days.md)

Converts a number to equivalent days.

```tql
days(100)
```

### [format\_time](https://preview.docs.tenzir.com/375/375/reference/functions/format_time.md)

Formats a time into a string that follows a specific format.

```tql
ts.format_time("%d/ %m/%Y")
```

### [from\_epoch](https://preview.docs.tenzir.com/375/375/reference/functions/from_epoch.md)

Interprets a duration as Unix time.

```tql
from_epoch(time_ms * 1ms)
```

### [hour](https://preview.docs.tenzir.com/375/375/reference/functions/hour.md)

Extracts the hour component from a timestamp.

```tql
ts.hour()
```

### [hours](https://preview.docs.tenzir.com/375/375/reference/functions/hours.md)

Converts a number to equivalent hours.

```tql
hours(100)
```

### [microseconds](https://preview.docs.tenzir.com/375/375/reference/functions/microseconds.md)

Converts a number to equivalent microseconds.

```tql
microseconds(100)
```

### [milliseconds](https://preview.docs.tenzir.com/375/375/reference/functions/milliseconds.md)

Converts a number to equivalent milliseconds.

```tql
milliseconds(100)
```

### [minute](https://preview.docs.tenzir.com/375/375/reference/functions/minute.md)

Extracts the minute component from a timestamp.

```tql
ts.minute()
```

### [minutes](https://preview.docs.tenzir.com/375/375/reference/functions/minutes.md)

Converts a number to equivalent minutes.

```tql
minutes(100)
```

### [month](https://preview.docs.tenzir.com/375/375/reference/functions/month.md)

Extracts the month component from a timestamp.

```tql
ts.month()
```

### [months](https://preview.docs.tenzir.com/375/375/reference/functions/months.md)

Converts a number to equivalent months.

```tql
months(100)
```

### [nanoseconds](https://preview.docs.tenzir.com/375/375/reference/functions/nanoseconds.md)

Converts a number to equivalent nanoseconds.

```tql
nanoseconds(100)
```

### [now](https://preview.docs.tenzir.com/375/375/reference/functions/now.md)

Gets the current wallclock time.

```tql
now()
```

### [parse\_time](https://preview.docs.tenzir.com/375/375/reference/functions/parse_time.md)

Parses a time from a string that follows a specific format.

```tql
"10/11/2012".parse_time("%d/%m/%Y")
```

### [second](https://preview.docs.tenzir.com/375/375/reference/functions/second.md)

Extracts the second component from a timestamp with subsecond precision.

```tql
ts.second()
```

### [seconds](https://preview.docs.tenzir.com/375/375/reference/functions/seconds.md)

Converts a number to equivalent seconds.

```tql
seconds(100)
```

### [since\_epoch](https://preview.docs.tenzir.com/375/375/reference/functions/since_epoch.md)

Interprets a time value as duration since the Unix epoch.

```tql
since_epoch(2021-02-24)
```

### [weeks](https://preview.docs.tenzir.com/375/375/reference/functions/weeks.md)

Converts a number to equivalent weeks.

```tql
weeks(100)
```

### [year](https://preview.docs.tenzir.com/375/375/reference/functions/year.md)

Extracts the year component from a timestamp.

```tql
ts.year()
```

### [years](https://preview.docs.tenzir.com/375/375/reference/functions/years.md)

Converts a number to equivalent years.

```tql
years(100)
```

## Utility

### [contains](https://preview.docs.tenzir.com/375/375/reference/functions/contains.md)

Searches for a value within data structures recursively.

```tql
this.contains("value")
```

### [contains\_null](https://preview.docs.tenzir.com/375/375/reference/functions/contains_null.md)

Checks whether the input contains any `null` values.

```tql
{x: 1, y: null}.contains_null() == true
```

### [is\_empty](https://preview.docs.tenzir.com/375/375/reference/functions/is_empty.md)

Checks whether a value is empty.

```tql
"".is_empty()
```

### [random](https://preview.docs.tenzir.com/375/375/reference/functions/random.md)

Generates a random number in *\[0,1]*.

```tql
random()
```

### [uuid](https://preview.docs.tenzir.com/375/375/reference/functions/uuid.md)

Generates a Universally Unique Identifier (UUID) string.

```tql
uuid()
```

## String

### Filesystem

### [file\_contents](https://preview.docs.tenzir.com/375/375/reference/functions/file_contents.md)

Reads a file's contents.

```tql
file_contents("/path/to/file")
```

### [file\_name](https://preview.docs.tenzir.com/375/375/reference/functions/file_name.md)

Extracts the file name from a file path.

```tql
file_name("/path/to/log.json")
```

### [parent\_dir](https://preview.docs.tenzir.com/375/375/reference/functions/parent_dir.md)

Extracts the parent directory from a file path.

```tql
parent_dir("/path/to/log.json")
```

### Inspection

### [ends\_with](https://preview.docs.tenzir.com/375/375/reference/functions/ends_with.md)

Checks if a string ends with a specified substring.

```tql
"hello".ends_with("lo")
```

### [is\_alnum](https://preview.docs.tenzir.com/375/375/reference/functions/is_alnum.md)

Checks if a string is alphanumeric.

```tql
"hello123".is_alnum()
```

### [is\_alpha](https://preview.docs.tenzir.com/375/375/reference/functions/is_alpha.md)

Checks if a string contains only alphabetic characters.

```tql
"hello".is_alpha()
```

### [is\_lower](https://preview.docs.tenzir.com/375/375/reference/functions/is_lower.md)

Checks if a string is in lowercase.

```tql
"hello".is_lower()
```

### [is\_numeric](https://preview.docs.tenzir.com/375/375/reference/functions/is_numeric.md)

Checks if a string contains only numeric characters.

```tql
"1234".is_numeric()
```

### [is\_printable](https://preview.docs.tenzir.com/375/375/reference/functions/is_printable.md)

Checks if a string contains only printable characters.

```tql
"hello".is_printable()
```

### [is\_title](https://preview.docs.tenzir.com/375/375/reference/functions/is_title.md)

Checks if a string follows title case.

```tql
"Hello World".is_title()
```

### [is\_upper](https://preview.docs.tenzir.com/375/375/reference/functions/is_upper.md)

Checks if a string is in uppercase.

```tql
"HELLO".is_upper()
```

### [length\_bytes](https://preview.docs.tenzir.com/375/375/reference/functions/length_bytes.md)

Returns the length of a string in bytes.

```tql
"hello".length_bytes()
```

### [length\_chars](https://preview.docs.tenzir.com/375/375/reference/functions/length_chars.md)

Returns the length of a string in characters.

```tql
"hello".length_chars()
```

### [match\_regex](https://preview.docs.tenzir.com/375/375/reference/functions/match_regex.md)

Checks if a string partially matches a regular expression.

```tql
"Hi".match_regex("[Hh]i")
```

### [slice](https://preview.docs.tenzir.com/375/375/reference/functions/slice.md)

Slices a string with offsets and strides.

```tql
"Hi".slice(begin=2, stride=4)
```

### [starts\_with](https://preview.docs.tenzir.com/375/375/reference/functions/starts_with.md)

Checks if a string starts with a specified substring.

```tql
"hello".starts_with("he")
```

### Transformation

### [capitalize](https://preview.docs.tenzir.com/375/375/reference/functions/capitalize.md)

Capitalizes the first character of a string.

```tql
"hello".capitalize()
```

### [join](https://preview.docs.tenzir.com/375/375/reference/functions/join.md)

Joins a list of strings into a single string using a separator.

```tql
join(["a", "b", "c"], ",")
```

### [pad\_end](https://preview.docs.tenzir.com/375/375/reference/functions/pad_end.md)

Pads a string at the end to a specified length.

```tql
"hello".pad_end(10)
```

### [pad\_start](https://preview.docs.tenzir.com/375/375/reference/functions/pad_start.md)

Pads a string at the start to a specified length.

```tql
"hello".pad_start(10)
```

### [replace](https://preview.docs.tenzir.com/375/375/reference/functions/replace.md)

Replaces characters within a string.

```tql
"hello".replace("o", "a")
```

### [replace\_regex](https://preview.docs.tenzir.com/375/375/reference/functions/replace_regex.md)

Replaces characters within a string based on a regular expression.

```tql
"hello".replace("l+o", "y")
```

### [repeat](https://preview.docs.tenzir.com/375/375/reference/functions/repeat.md)

Repeats a string a specified number of times.

```tql
"na".repeat(8)
```

### [reverse](https://preview.docs.tenzir.com/375/375/reference/functions/reverse.md)

Reverses the characters of a string.

```tql
"hello".reverse()
```

### [split](https://preview.docs.tenzir.com/375/375/reference/functions/split.md)

Splits a string into substrings.

```tql
split("a,b,c", ",")
```

### [split\_regex](https://preview.docs.tenzir.com/375/375/reference/functions/split_regex.md)

Splits a string into substrings with a regex.

```tql
split_regex("a1b2c", r"\d")
```

### [to\_lower](https://preview.docs.tenzir.com/375/375/reference/functions/to_lower.md)

Converts a string to lowercase.

```tql
"HELLO".to_lower()
```

### [to\_title](https://preview.docs.tenzir.com/375/375/reference/functions/to_title.md)

Converts a string to title case.

```tql
"hello world".to_title()
```

### [to\_upper](https://preview.docs.tenzir.com/375/375/reference/functions/to_upper.md)

Converts a string to uppercase.

```tql
"hello".to_upper()
```

### [trim](https://preview.docs.tenzir.com/375/375/reference/functions/trim.md)

Trims whitespace or specified characters from both ends of a string.

```tql
" hello ".trim()
```

### [trim\_end](https://preview.docs.tenzir.com/375/375/reference/functions/trim_end.md)

Trims whitespace or specified characters from the end of a string.

```tql
"hello ".trim_end()
```

### [trim\_start](https://preview.docs.tenzir.com/375/375/reference/functions/trim_start.md)

Trims whitespace or specified characters from the start of a string.

```tql
" hello".trim_start()
```

## Type System

### Conversion

### [duration](https://preview.docs.tenzir.com/375/375/reference/functions/duration.md)

Casts an expression to a duration value.

```tql
duration("1.34w")
```

### [float](https://preview.docs.tenzir.com/375/375/reference/functions/float.md)

Casts an expression to a float.

```tql
float(42)
```

### [int](https://preview.docs.tenzir.com/375/375/reference/functions/int.md)

Casts an expression to an integer.

```tql
int(-4.2)
```

### [ip](https://preview.docs.tenzir.com/375/375/reference/functions/ip.md)

Casts an expression to an IP address.

```tql
ip("1.2.3.4")
```

### [string](https://preview.docs.tenzir.com/375/375/reference/functions/string.md)

Casts an expression to a string.

```tql
string(1.2.3.4)
```

### [subnet](https://preview.docs.tenzir.com/375/375/reference/functions/subnet.md)

Casts an expression to a subnet value.

```tql
subnet("1.2.3.4/16")
```

### [time](https://preview.docs.tenzir.com/375/375/reference/functions/time.md)

Casts an expression to a time value.

```tql
time("2020-03-15")
```

### [uint](https://preview.docs.tenzir.com/375/375/reference/functions/uint.md)

Casts an expression to an unsigned integer.

```tql
uint(4.2)
```

### Introspection

### [internal\_memory\_size](https://preview.docs.tenzir.com/375/375/reference/functions/internal_memory_size.md)

Estimates the internal memory size of a value in bytes.

```tql
internal_memory_size(this)
```

### [type\_id](https://preview.docs.tenzir.com/375/375/reference/functions/type_id.md)

Retrieves the type id of an expression.

```tql
type_id(1 + 3.2)
```

### [type\_of](https://preview.docs.tenzir.com/375/375/reference/functions/type_of.md)

Retrieves the type definition of an expression.

```tql
type_of(this)
```

### Transposition

### [flatten](https://preview.docs.tenzir.com/375/375/reference/functions/flatten.md)

Flattens nested data.

```tql
flatten(this)
```

### [unflatten](https://preview.docs.tenzir.com/375/375/reference/functions/unflatten.md)

Unflattens nested data.

```tql
unflatten(this)
```