Humio Query Examples

https://library.humio.com/examples
Admin
Humio Query Examples is a comprehensive documentation library providing query examples and use cases...
Tokens:264,988
Snippets:3,262
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example Incoming Data

Source: https://library.humio.com/examples/examples-array-append-newarray.html

Sample event data showing the source and destination user name fields used in the array:append() example.

```text
source.user.name="user_1" destination.user.name="USER_2"
```

--------------------------------

### Full Query Example with setTimeInterval and defineTable

Source: https://library.humio.com/examples/examples-settimeinterval-definetable.html

A complete query example demonstrating the use of setTimeInterval() followed by defineTable() and a match() operation.

```logscale
setTimeInterval(start="1h", end="30min")
| defineTable(
start=7d,
end=1d,
query={...},
name="ended_queries")
| match(table="ended_queries", field=queryID, strict=true)
```

--------------------------------

### Example incoming data

Source: https://library.humio.com/examples/examples-array-rename-fields.html

Sample structure of incoming data with sequential indexes.

```text
'mail[0]'='user0@example.com'
'mail[1]'='user1@example.com'
'mail[2]'='user2@example.com'
```

--------------------------------

### Inner Join Query Example

Source: https://library.humio.com/examples/examples-define-table-inner.html

A complete query example using defineTable() and match() to perform an inner join.

```logscale
defineTable(name="users_table",query={orgId=1},include=[username, name])
| orgId=1
| operation=createdFile
| match(table=users_table, field=username)
| select([username, name])
```

--------------------------------

### Sample incoming data

Source: https://library.humio.com/examples/examples-stats-3-cartesian.html

Example of raw log data formatted as key-value pairs.

```logscale
"x=1 y=10 z=100"
"x=2 y=20 z=200"
```

--------------------------------

### Raw event data example

Source: https://library.humio.com/examples/examples-in-wildcard.html

Example of raw log data containing srcIP, loglevel, status, and user fields.

```text
srcIP=192.168.1.5 loglevel=ERROR status=404 user=admin  
---  
srcIP=10.0.0.1 loglevel=INFO status=200 user=user1  
srcIP=172.16.0.5 loglevel=WARN status=422 user=user2  
srcIP=192.168.1.15 loglevel=ERROR status=500 user=admin  
srcIP=10.0.0.12 loglevel=DEBUG status=302 user=user1
```

--------------------------------

### Right Join Query Example

Source: https://library.humio.com/examples/examples-define-table-right.html

A complete query example using defineTable and match to perform a right join between users and operations datasets.

```logscale
defineTable(name="users",query={orgId=1},include=[username, name])
| defineTable(name="operations",query={*},include=[username, operation])
| readFile(users)
| match(operations, field=username, strict=false)
| select([username, operation])
```

--------------------------------

### Full copyEvent() query example

Source: https://library.humio.com/examples/examples-copyevent-extracopy-1.html

A complete query example demonstrating the use of copyEvent() combined with a case statement to handle different event types.

```logscale
copyEvent("arrivaltime")
| case { #type=arrivaltime
| @timestamp:=now() ; *
| parseTimestamp(field=ts) }
```

--------------------------------

### Sample Incoming Data

Source: https://library.humio.com/examples/examples-array-filter-condition.html

Example of the input array structure before applying the filter.

```logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=baz@example.com
```

--------------------------------

### Sample Query Output

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-7c1de40c-f100-4206-b44d-12ae839f7487.html

Example output showing the aggregated counts for different operation names.

```csv
[{"_count":"3","event.OperationName":"update_precedence"},
{"_count":"2","event.OperationName":"update_report"},
{"_count":"1","event.OperationName":"validateEntitlementsHmac"},
{"_count":"1","event.OperationName":"updateDetection"},
{"_count":"3","event.OperationName":"update_policy"}]
```

--------------------------------

### Sample Incoming Data

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-7c1de40c-f100-4206-b44d-12ae839f7487.html

Example of the raw JSON data structure expected for the user activity events.

```json
[{"metadata.eventType":"UserActivityAuditEvent","event.OperationName":"delete_report_execution","event.UserId":"adamsb","event.UserIp":"192.168.2.143","@timestamp":1768898479081}]
```

--------------------------------

### Sample Query Output

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-10e53534-d025-429d-b56e-8a99e5a97792.html

Example JSON output representing the aggregated policy events per user.

```csv
[{"User":"whitep","events":"1"},
{"User":"wrightj","events":"1"},
{"User":"youngd","events":"1"},
{"User":"thomasb","events":"1"},
{"User":"watsonm","events":"1"}]
```

--------------------------------

### Sample Output Result

Source: https://library.humio.com/examples/examples-objectarrayeval-concat-nested-2.html

The resulting concatenated value from the example input data.

```text
out[0]: 124
```

--------------------------------

### Example incoming CSV data

Source: https://library.humio.com/examples/examples-parsecsv-2.html

Sample CSV data containing spaces and quotes.

```csv
117, " crowdstrike.com, logscale.com ", 3.14
```

--------------------------------

### CSV trim behavior example

Source: https://library.humio.com/examples/examples-parsecsv-2.html

Example input showing how spaces around separators are handled when trim is set to true.

```csv
117 , " crowdstrike.com, humio.com " , 3.14
```

```csv
117," crowdstrike.com, humio.com ",3.14
```

--------------------------------

### Profile a query with explain:asTable()

Source: https://library.humio.com/examples/examples-explain-astable-profile.html

A complete query example using explain:asTable() with prefilter statistics disabled.

```logscale
x = 42
| count()
| explain:asTable(showPrefilters=false)
```

--------------------------------

### Calculate Sine with math:sin()

Source: https://library.humio.com/examples/examples-mathsin-positive-value.html

A complete query example demonstrating the assignment of a value and the calculation of its sine.

```logscale
myvalue := 345
| math:sin(myvalue, as=mathvalue)
```

--------------------------------

### Sample Incoming Data

Source: https://library.humio.com/examples/examples-array-intersection.html

Example of the raw data structure containing multiple email entries.

```logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=bar@example.com
```

--------------------------------

### Example event array

Source: https://library.humio.com/examples/examples-getfield-3.html

The structure of the event containing an array for field foo.

```logscale
foo['a','b','c','d']
```

--------------------------------

### Query using getField with parameters

Source: https://library.humio.com/examples/examples-getfield-2.html

A basic query example demonstrating the use of getField with two parameters, ?foo and ?bar.

```logscale
| test(getField(?foo)==?bar)
```

--------------------------------

### Calculate Sum with slidingTimeWindow

Source: https://library.humio.com/examples/examples-slidingtimewindow.html

A complete query example using head() and slidingTimeWindow() to calculate a sum over a 3-second window.

```logscale
head()
| slidingTimeWindow(sum(value), span=3s)
```

--------------------------------

### Example incoming event data

Source: https://library.humio.com/examples/examples-match-multiple-pairs.html

Sample JSON structure for incoming events containing field1 and field2.

```json
[
   {
      "field1" : "c",
      "field2" : "f"
   },
   {
      "field2" : "e",
      "field1" : "c"
   }
]
```

--------------------------------

### Sample incoming data

Source: https://library.humio.com/examples/examples-stats-2.html

Example of incoming data format containing key-value pairs with non-numeric values.

```logscale
"x=1 y=N/A"
"x=2 y=N/A"
```

--------------------------------

### Example event structure

Source: https://library.humio.com/examples/examples-getfield-2.html

The structure of an event containing a field named hello with the value world.

```text
|----------------------|
| hello      | world   |
|----------------------|
```

--------------------------------

### Example incoming XML data

Source: https://library.humio.com/examples/examples-parsexml-multiple-inner.html

Sample raw XML data containing multiple inner elements to be parsed.

```xml
<outer><inner>1</inner><inner>2</inner><inner>3</inner></outer>
```

--------------------------------

### Translated Output Example

Source: https://library.humio.com/examples/examples-objectarrayeval-nested-to-flat.html

Shows how a specific array element is transformed into the new flat array format.

```logscale
_mapped[0]: a0b0
```

--------------------------------

### MD5 Hash Query

Source: https://library.humio.com/examples/examples-crypto-md5-2-2.html

A complete query example demonstrating how to assign a string to a field and generate its MD5 hash.

```logscale
a := "Hello, world!"
| crypto:md5(a)
```

--------------------------------

### Sample Incoming Data Structure

Source: https://library.humio.com/examples/examples-objectarrayeval-nested-to-flat.html

Example of the input data format containing nested array elements and other fields.

```json
arr[0]: machine
arr[0].a: a0
arr[0].b: b0
arr[1].a: a1
arr[1].b: b1
arr[1].c: c1
arr[2].a: a2
arr[4].b: b2
other: abc
```

--------------------------------

### Visualize Zero-Based Indexing

Source: https://library.humio.com/examples/examples-textsubstring-remove-fixed-prefix-suffix.html

Illustrates how the zero-based index 7 corresponds to the 8th character in the string '[START]I'.

```text
[ S T A R T ] I
0 1 2 3 4 5 6 7
```

--------------------------------

### Calculate Arc Sine Query

Source: https://library.humio.com/examples/examples-matharcsin-calculate-arcsine.html

A complete query example demonstrating the calculation of the arc sine of 0.5.

```logscale
x := 0.5
| math:arcsin(x, as=angle)
```

--------------------------------

### SHA-1 Hash Query

Source: https://library.humio.com/examples/examples-crypto-sha1-2.html

A complete query example demonstrating how to assign a string to a field and generate its SHA-1 hash.

```logscale
a := "Hello, world!"
| crypto:sha1(a)
```

--------------------------------

### Filter HTTP GET Requests and Select Fields

Source: https://library.humio.com/examples/examples-select-http-get.html

A complete query example that filters for HTTP GET requests and selects the statuscode and responsetime fields.

```logscale
method=GET
| select([statuscode, responsetime])
```

--------------------------------

### Start case statement for dropEvent()

Source: https://library.humio.com/examples/examples-dropevent-2.html

The beginning of a case statement identifying lines starting with a hash symbol to be dropped.

```logscale
case {
@rawstring="#*"
| dropEvent();
```

--------------------------------

### CSV without trim behavior example

Source: https://library.humio.com/examples/examples-parsecsv-2.html

Example input showing how spaces are included when trim is set to false.

```csv
117 , " crowdstrike.com, humio.com " , 3.14
```

```csv
117 , " crowdstrike.com, humio.com  "
```

--------------------------------

### Sample, Group, and Sort Events Query

Source: https://library.humio.com/examples/examples-sample-events-sort.html

A complete query example that samples 0.1% of events, groups them by host, and sorts the results.

```logscale
sample(percentage=0.1)
| groupBy(host)
| sort()
```

--------------------------------

### Alternative Time Chart Queries

Source: https://library.humio.com/examples/examples-timechart-method-buckets.html

These queries demonstrate how to visualize HTTP method distribution with fixed buckets or automatic bucket sizing.

```logscale
#kind=requests |         timeChart(buckets=10, series=method, function=count())
```

```logscale
#kind=requests | timeChart(series=method,         function=count())
```

--------------------------------

### Sample events using sample() function

Source: https://library.humio.com/examples/examples-sample-events-percentage.html

This query uses the sample() function to retain 2% of the events from the input stream.

```logscale
sample(percentage=2)
```

--------------------------------

### Drop Event Query Example

Source: https://library.humio.com/examples/examples-dropevent-1.html

A complete query example demonstrating the use of dropEvent() within a case statement to filter specific JSON field values.

```logscale
parseJson()
| case { someField = "some_value"
| dropEvent(); * }
| parseTimestamp(field=@timestamp)
```

--------------------------------

### Search status codes starting with 1 or 2 using in()

Source: https://library.humio.com/examples/examples-in-wildcard.html

Use the in() function with wildcard strings to filter for status codes starting with '1' or '2'. Double quotes are required around the wildcard values.

```logscale
in(status, values=["1*", "2*"])
```

--------------------------------

### Select Fields Step

Source: https://library.humio.com/examples/examples-define-table-csv.html

Step 5: Selects the username and name fields for the final output.

```logscale
| select([username, name])
```

--------------------------------

### Calculate log1p with math:log1p()

Source: https://library.humio.com/examples/examples-mathlog1p-calculate-logarithm.html

A complete query example demonstrating the assignment of a small value to a field and the subsequent calculation of its natural logarithm plus one.

```logscale
x := 0.0001
| math:log1p(x, as=log1p_result)
```

--------------------------------

### Filter events by relative time using start()

Source: https://library.humio.com/examples/examples-relative-time.html

This query tests if the @timestamp field is earlier than the start time plus 30 days. The time duration is calculated by multiplying days, hours, minutes, seconds, and milliseconds.

```logscale
test(@timestamp < (start() + (30*24*60*60*1000)))
```

--------------------------------

### Create Sample Groups with hash() and groupBy()

Source: https://library.humio.com/examples/examples-hash-groupby-sampling.html

This query hashes the ip_address field into 10 buckets and then groups the events by the resulting hash value to count occurrences.

```logscale
hash(ip_address, limit=10)
| groupBy(_hash, function=count())
```

--------------------------------

### Filter by Method

Source: https://library.humio.com/examples/examples-groupby-sort-excludenovalue.html

Initial step to filter events by the GET method.

```logscale
method=GET
```

--------------------------------

### Calculate HTTP Error Percentages with percentage()

Source: https://library.humio.com/examples/examples-percentage-http-errors.html

This query uses an array to perform two simultaneous percentage calculations: one for client-side errors (status starting with 4) and one for server-side errors (status starting with 5). The wildcard * matches any digits following the initial status code digit.

```logscale
[
        percentage({status=4*}, as=clientErrorPct),
        percentage({status=5*}, as=serverErrorPct)
]
```

--------------------------------

### Calculate floor value with math:floor()

Source: https://library.humio.com/examples/examples-mathfloor-calculate-floor.html

A complete query example demonstrating the assignment of a floating-point number and the subsequent calculation of its floor value.

```logscale
x := 3.7
| math:floor(x, as=floor_result)
```

--------------------------------

### Calculate Power with math:pow()

Source: https://library.humio.com/examples/examples-mathpow-calculate-power.html

A complete example showing the assignment of base and exponent fields followed by the math:pow() function call.

```logscale
x := 2
exp := 3
| math:pow(field=x, exponent=exp, as=result)
```

--------------------------------

### Drop events with dropEvent()

Source: https://library.humio.com/examples/examples-dropevent-2.html

A case statement that drops events starting with a hash symbol.

```logscale
case {
@rawstring="#*"
| dropEvent();
* }
```

--------------------------------

### Filter Docker container status

Source: https://library.humio.com/examples/examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957.html

Filters for containers where the docker.container.status field starts with 'U' (Up).

```logscale
docker.container.status = "U*"
```

--------------------------------

### Filter Array with regex

Source: https://library.humio.com/examples/examples-array-regex-1.html

Filters the incidents array for values that start with 'Cozy Bear'.

```logscale
array:regex("incidents[]", regex="^Cozy Bear.*")
```

--------------------------------

### Calculate Cosine Query

Source: https://library.humio.com/examples/examples-mathcos-cosine.html

A complete query example calculating the cosine of 1.0472 radians.

```logscale
x := 1.0472
| math:cos(x, as=result)
```

--------------------------------

### Select All Events Step

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-69e734f1-700d-4467-b116-41e5e247ae26.html

The initial step selecting all events from the data stream.

```logscale
*
```

--------------------------------

### Example Incoming JSON Data

Source: https://library.humio.com/examples/examples-createevents-parsejson.html

The structure of the incoming data that the query is designed to process.

```json
[
{"animal":{"kind":"dog", "weight":7.0}},
{"animal":{"kind":"cat", "weight":4.2}}
]
```

--------------------------------

### Example CSV Data Structure

Source: https://library.humio.com/examples/examples-readfile-join-1.html

The expected format of the incoming CSV data used for the lookup.

```text
|--------------------|
| host_name, host_id |
| DESKTOP-VSKPBK8, 1 |
| FINANCE, 2         |
| homer-xubuntu, 3   |
| logger, 4          |
| DESKTOP-1, 5       |
| DESKTOP-2, 6       |
| DESKTOP-3, 7       |
|--------------------|
```

--------------------------------

### Example Incoming Data Structure

Source: https://library.humio.com/examples/examples-objectarrayeval-concat-nested-2.html

A representation of the nested data structure that the concatenation query processes.

```json
in[0].a: 1
in[0].b.c: 2
in[0].others[0].d: 3
in[0].others[1].d: 4
```

--------------------------------

### Calculate angle with math:arctan2()

Source: https://library.humio.com/examples/examples-matharctan2-calculate-angle.html

A complete query example that assigns coordinates and calculates the angle.

```logscale
x := 1.0
y := 1.0
| math:arctan2(y=y, x=x, as=angle)
```

--------------------------------

### Timestamp Parsing Error Log

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-60fe2343-77ce-483b-b7ff-c43bd30e674c.html

An example of an error message generated when a timestamp cannot be parsed correctly.

```text
errormsg="Text '2025-03-14:00:15:26 +0900' could not be parsed at index 10" zone=""| false| 1sQGV7fQ8QZ5E5UlagdqsmIs_4_128_1768499251| 2026-01-15T17:47:31| ...
2026-01-15T17:47:31| true| auto-dashboard-queries| CrowdStrike_Falcon_Devices| true| Error parsing timestamp.
```

--------------------------------

### Display Results in Table

Source: https://library.humio.com/examples/examples-groupby-ioc-lookup-domain-malicious.html

Formats the output into a table showing the domain name and the labels from the first IOC match.

```logscale
| table([DomainName, "ioc[0].labels"])
```

--------------------------------

### Example Incoming Data Structure

Source: https://library.humio.com/examples/examples-zscaler-internet-access-d2752bdb-a3b8-42a5-a3f2-6dd4ebd44538.html

A representation of the expected fields and structure for incoming Zscaler Internet Access web traffic data.

```text
@timestamp| #Cps.version| #Vendor| #ecs.version| #error| #event.dataset| #event.kind| #event.module| #event.outcome| #repo| #type| @error| @error_msg| @error_msg[0]| @event_parsed| @id| @ingesttimestamp| @rawstring| @timestamp.nanos| @timezone| Parser.version| Vendor.Recordtype| Vendor.action| Vendor.actiontaken| Vendor.adminid| Vendor.algo| Vendor.applicationname| Vendor.auditlogtype| Vendor.authentication| Vendor.authtype| Vendor.category| Vendor.channel| Vendor.clientip| Vendor.company| Vendor.datetime| Vendor.dept| Vendor.destinationip| Vendor.destinationipend| Vendor.destinationipstart| Vendor.destinationport| Vendor.destinationportstart| Vendor.dlpdictcount| Vendor.dlpdictnames| Vendor.dlpenginenames| Vendor.errorcode| Vendor.filedownloadtimems| Vendor.filemd5| Vendor.filename| Vendor.filescantimems| Vendor.filesource| Vendor.filetypename| Vendor.fullurl| Vendor.ikeversion| Vendor.interface| Vendor.itemdstname| Vendor.lastmodtime| Vendor.lifebytes| Vendor.lifetime| Vendor.location| Vendor.login| Vendor.policy| Vendor.policydirection| Vendor.protocol| Vendor.recordid| Vendor.resource| Vendor.result| Vendor.rulename| Vendor.severity| Vendor.sourceip| Vendor.sourceport| Vendor.sourceportstart| Vendor.sourcetype| Vendor.spi| Vendor.spi_in| Vendor.spi_out| Vendor.srcipend| Vendor.srcipstart| Vendor.subcategory| Vendor.tenant| Vendor.threatname| Vendor.time| Vendor.tunnelprotocol| Vendor.tunneltype| Vendor.user| destination.address| destination.ip| destination.port| event.action| event.category[0]| event.category[1]| event.category[2]| event.id| event.severity| event.type[0]| file.directory| file.extension| file.hash.md5| file.name| group.name| network.direction| network.type| rule.name| source.address| source.geo.name| source.ip| source.port| url.full| url.path| user.domain| user.email| user.name
```

--------------------------------

### Reverse Base64 Encoding

Source: https://library.humio.com/examples/examples-base64encode-store-encoded.html

Example of encoding a field and subsequently decoding it back to its original form.

```logscale
base64Encode(a, as=a) | base64Decode(field=a,         as=a) 
```

--------------------------------

### Copy events between repositories using copyEvent and case

Source: https://library.humio.com/examples/examples-copyevent-repo-repo.html

A complete query example showing how to clone an event and route it to a target repository.

```logscale
copyEvent("cloned_event")
| case { #type="cloned_event"
| repo := "target-repo-name"; * }
```

--------------------------------

### Preview CSV Content with readFile()

Source: https://library.humio.com/examples/examples-readfile-join-1.html

Initial step to display the contents of the specified CSV file.

```logscale
readFile("host_names.csv")
```

--------------------------------

### Get Current Time

Source: https://library.humio.com/examples/examples-selectlast-monitor-stale-sources.html

Retrieves the current time as a reference point for elapsed time calculations.

```logscale
currenttime := now()
```

--------------------------------

### Display results in a table

Source: https://library.humio.com/examples/examples-crowdstrike-intel-indicators-764c98ca-222b-42b1-8580-b8dfcce7e0a7.html

Creates a table displaying the specified fields in the given order.

```logscale
| table(["Malware Family", "Count"])
```

--------------------------------

### Incoming CSV Log Data

Source: https://library.humio.com/examples/examples-text-trim-trailing-whitespace.html

Example of incoming log data containing messages with trailing whitespace.

```csv
"@timestamp","level","message"
"2025-11-05T10:00:00Z","INFO","User login successful "
"2025-11-05T10:00:01Z","WARN","Failed password attempt "
"2025-11-05T10:00:02Z","INFO","Session timeout "
"2025-11-05T10:00:03Z","ERROR","Database connection lost "
"2025-11-05T10:00:04Z","INFO","Cache cleared "
"2025-11-05T10:00:05Z","DEBUG","Memory usage: 85% "
```

--------------------------------

### Set multiple field values with setField()

Source: https://library.humio.com/examples/examples-setfield-2.html

A complete query example demonstrating how to assign values to multiple fields using setField().

```logscale
item := 4
| bar := "baz"
| setField(target=bar, value=item + 10)
| setField(target="foo", value=item + 20)
| setField(target="baaz", value=if(item == 4, then="OK", else="not OK"))
```

--------------------------------

### Calculate Hyperbolic Tangent Query

Source: https://library.humio.com/examples/examples-mathtanh-calculate-single-value.html

A complete query example that assigns a value and calculates its hyperbolic tangent.

```logscale
myvalue := 120
| math:tanh(myvalue, as=tanh_value)
```

--------------------------------

### Bucket Events by Repository

Source: https://library.humio.com/examples/examples-events-count-repo.html

Step 2: Buckets the values using the field #repo and a count() function.

```logscale
bucket(span=1d,field=#repo,function=count())
```

--------------------------------

### Calculate tangent with math:tan()

Source: https://library.humio.com/examples/examples-mathtan-calculate-single-value.html

A complete query example that assigns a value of 120 and calculates its tangent.

```logscale
myvalue := 120
| math:tan(myvalue, as=tangent_value)
```
Tokens:
Raw