Expression functions reference

AI summary

Explains how to use operators and functions in Imply Lumi expression processors to transform event data. Covers string operations, numeric calculations, Boolean logic, and multi-value field manipulation. Details syntax, examples, and operator precedence for building expressions in pipelines.

About AI summaries.

Pipelines in Imply Lumi transform incoming events. You can create an expression processor in a pipeline to perform string operations, numeric calculations, or logic evaluations.

An expression processor evaluates a single expression and assigns the result to a user attribute. The expression can include multiple functions, such as to evaluate an arithmetic formula and only assign its value when a condition passes. See the processor reference for expression syntax and usage details.

This reference describes supported operators and functions for the expression processor. Each function includes an example you can try to learn how it works.

How to try examples

You can use the Try it out section of a processor to test expressions and learn how functions work.

To try out an example:

From the Lumi navigation menu, click Pipelines and create or select a pipeline.
Click Create > Processor and select the Expression processor type.
If you plan to create the processor, enter a name and description. You don't need to create a processor to try it out.
In Expression, copy and paste the expression in the example.
In Output attribute, enter the name of the attribute from the example's expression output.
In the Try it out section, copy and paste the expression input for Sample attributes.
View the transformed results in Expected output. It should include the expression output described in the example.
Note that the examples in this reference only show output attributes for expressions, but the processor retains existing user attributes.

Operators

Type	Operator	Description
Arithmetic	`+` `-` `*` `/` `%`	Addition, subtraction, multiplication, division, modulo
Arithmetic	`-` (unary)	Negative value, such as `-5`
Arithmetic	`()`	Controls order of operations
Boolean	`AND` `OR` `XOR` `NOT`	Logical operations. Null or missing inputs evaluates to `FALSE`.
Comparison	`=` `==`	Equal
Comparison	`!=`	Not equal
Comparison	`<` `<=` `>` `>=`	Less than, less than or equal to, greater than, greater than or equal to
Concatenation	`.`	Performs string concatenation. Use single quotes `'` for attribute names and double quotes `"` for string literals.

Order of operations

Lumi applies the operators in the following order of precedence from highest to lowest:

Negation: Unary -, NOT
Multiplicative operations: * / %
Additive operations: + -
String concatenation: .
Comparisons: = == != < <= > >=
AND
XOR
OR

Note that predicate functions such as IN or LIKE return true, false, or null values. They take the same precedence as comparison operators and can't be the top-level output of an expression.

Truth tables

The following truth tables describe how Boolean operations resolve. Results that involve null values are shown in bold.

AND, OR, XOR operators:

`a`	`b`	`a AND b`	`a OR b`	`a XOR b`
TRUE	TRUE	TRUE	TRUE	FALSE
TRUE	FALSE	FALSE	TRUE	TRUE
TRUE	NULL	FALSE	TRUE	TRUE
FALSE	TRUE	FALSE	TRUE	TRUE
FALSE	FALSE	FALSE	FALSE	FALSE
FALSE	NULL	FALSE	FALSE	FALSE
NULL	TRUE	FALSE	TRUE	TRUE
NULL	FALSE	FALSE	FALSE	FALSE
NULL	NULL	FALSE	FALSE	FALSE

NOT operator:

`a`	`NOT a`
TRUE	FALSE
FALSE	TRUE
NULL	TRUE

Note that unlike some SQL dialects, null values resolve to false, following Splunk® semantics. A null value can come from:

NULL or NULLIF functions
A function with an invalid argument, such as TONUMBER('abc', 10)
A function that operates on a null argument, such as a nonexistent source attribute

The functions that never produce a null result are ISNULL, ISNOTNULL, ISNUM.

CASE

CASE(cond1, val1, cond2, val2, ..., [default])

Takes one or more condition-value pairs—cond, val—and returns the first value whose condition is true and non-null. If no conditions match, CASE returns either null or the default value:

Null if you provide an even number of arguments
The final (default) value if you have an odd number of arguments

Example

Classifies the type of IP address based on srcip or dstip and assigns it to ipType.

Expression

Event input: {"dstip": "192.0.2.105"}

Expression output: ipType: ipv4

In this example, srcip doesn't exist, so the second condition applies. Since dstip doesn't have the : character, the IF condition is false and returns ipv4.

CEIL

CEIL(n)

Alias for CEILING.

CEILING

CEILING(n)

For a numeric literal n, rounds up to the nearest integer. Aliased by CEIL.

Example

Assigns and overwrites hours from the number of hours rounded up.

Expression: CEILING(hours)

Event input: {"hours": 5.8}

Expression output: hours: 6

CIDRMATCH

CIDRMATCH(cidr, ip)

Returns true if the CIDR range cidr contains IP address ip, false otherwise, or null if either argument is null. Note that IPv4 and IPv6 addresses are incompatible and always return false.

COALESCE

COALESCE(a, b, ...)

For two or more inputs, returns the first non-null value, else null.

Example

Assigns last_update from the return_date or order_date if available.

Expression: COALESCE(return_date, order_date, "1900-01-01")

Event input: {"order_date": "2026-01-28T06:19:54Z"}

Expression output: last_update: 2026-01-28T06:19:54Z

CONCAT

CONCAT(a, b, ...)

Joins two or more inputs into a single result while skipping null values.

Note that you can also concatenate strings with the addition (+) or dot (.) operators. The following expressions are equivalent:

CONCAT(size, " ", units)
size + " " + units
size." ".units

Example

Assigns volume from combining size and units.

Expression: CONCAT(size, " ", units)

Event input: {"size": 2, "units": "GB"}

Expression output: volume: 2 GB

CONTAINS

CONTAINS(s, substring)

Returns true if string literal s contains substring, false otherwise, or null if either argument is null.

ENDS_WITH

ENDS_WITH(s, suffix)

Returns true if string literal s ends with suffix, false otherwise, or null if either argument is null.

FLOOR

FLOOR(n)

For a numeric literal n, rounds down to the nearest integer.

Example

Assigns and overwrites rating_bucket from a store's rating rounded down.

Expression: FLOOR(rating)

Event input: {"rating": 4.2}

Expression output: rating_bucket: 4

IF

IF(cond, then, else)

Returns then if predicate expression cond is true and non-null. Otherwise returns else.

Example

Assigns source from srcip if it exists.

Expression: IF(ISNOTNULL(srcip), srcip, NULL())

Event input: {"dstip": "172.16.200.2"}

Expression output: source not created

IN

IN(field, c1, c2, ...)

Returns true if field equals any candidate c, skipping any null c values.

When there isn't a match:

Returns false if all arguments are non-null
Returns null if field is null
Returns null if at least one c value is null

ISNOTNULL

ISNOTNULL(x)

Returns true if x isn't null, false otherwise.

ISNULL

ISNULL(x)

Returns true if x is null, false otherwise.

ISNUM

ISNUM(x)

Returns true if x exists and is a native numeric type, false otherwise.
A string parameter that contains a number, such as "10", return false.

LEN

LEN(s)

Alias for LENGTH.

LENGTH

LENGTH(s)

For string literal s, returns the number of characters. Aliased by LEN.

Example

Assigns len_zip from the length of a zip code.

Expression: LENGTH(zip)

Event input: {"zip": 92617}

Expression output: len_zip: 5

LIKE

LIKE(s, pattern)

Returns true if a string pattern matches the string literal s, similar to the SQL LIKE operator. Returns false if pattern doesn't match s, and returns null if either argument is null.

You can use the following wildcard characters in pattern. To match a literal % or _, escape with a backslash: \%, \_.

%: matches zero or more characters, similar to glob pattern *. For example, 192% matches 192 or 192.0.0.1.
_: matches exactly one character, similar to glob pattern ?. For example, file_.txt matches file1 but not file123.txt.

LOWER

LOWER(s)

For string literal s, converts to lowercase.

Example

Assigns email after normalizing an email address to lower case.

Expression: LOWER(email)

Event input: {"email": "User@Example.com"}

Expression output: email: user@example.com

LTRIM

LTRIM(s)

For string literal s, removes leading whitespace.

Example

Assigns employee_id after stripping leading spaces from a fixed-width form field.

Expression: LTRIM(employee_id)

Event input: {"employee_id": " E4821"}

Expression output: employee_id: E4821

MATCH

MATCH(s, regex)

Returns true if regex pattern matches anywhere in string literal s, false if there isn't a match, or null if either argument is null.

MV_TO_JSON_ARRAY

MV_TO_JSON_ARRAY(mv[, infer_types])

Converts a multi-value field to a JSON array and returns it as a serialized string.

The optional Boolean infer_types controls how each element is serialized:

false (default): serializes each element as a string.
For example: ["42","true","hello","null","{}"]
true: serialize elements to their native, scalar JSON types. Non-scalar types (objects and arrays) become null.
For example: [42,true,"hello",null,null]

Both examples use the multi-value field 42|true|hello|null|{}.

MVAPPEND

MVAPPEND(a, b, ...)

Concatenates two or more values or multi-value fields into a single multi-value field. Combines elements in order from left to right and joins them with the pipe delimiter |.

For empty or null arguments:

Preserves an empty field for empty strings. For example, MVAPPEND("a", "", "c") returns a||c.
Skips null arguments completely. For example, MVAPPEND("a", missing_field, "c") returns a|c.
Returns null if all arguments are null.

MVCOUNT

MVCOUNT(mv)

Returns the number of values in a multi-value field; returns 0 if the field is null or empty.

MVDEDUP

MVDEDUP(mv)

Removes duplicate values from a multi-value field, preserving the order of first occurrence.

MVFILTER

MVFILTER(predicate)

Evaluates a predicate expression that operates on a multi-value field and returns the elements for which the predicate is true. The expression can be any predicate function or Boolean operation that references a single user attribute, such as ISNUM(mv) or IN(mv, "prod", "staging"). A null result coerces to false. The result can be the original multi-value field, a subset, or null.

MVFIND

MVFIND(mv, regex)

Returns the zero-based index of the first element in a multi-value field that matches regex. Returns null if no element matches.

MVINDEX

MVINDEX(mv, start[, end])

Returns the element from a multi-value field at index start, optionally returning values through and including the index end. For the start and end indexes, a negative value counts from the end, and an out-of-range value returns null.

MVJOIN

MVJOIN(mv, delim)

Joins the elements of a multi-value field into a single string using delim as the separator. A pipe delimiter | returns the same input.

MVMAP

MVMAP(mv, expr)

Applies an expression to each element of a multi-value field and returns the results as a new multi-value field. The expression must operate on the specified multi-value field and can use any function or operation supported in the expression processor.

If an operation on one of the elements yields a null result, the element is silently dropped. For example, with scores: "10|abc|20", the expression MVMAP(scores, ROUND(scores)) returns "10|20".

MVRANGE

MVRANGE(start, end[, step])

Generates a sequence of numbers from start up to but not including end, incrementing by step (defaults to 1). Returns null if the range contains 1000 or more elements.

Note the following requirements:

start must be less than end
step must be a positive integer, decimal, or timestamp string

A timestamp string contains a positive number and time unit with zero or more space characters, such as 7d or 1 hr. The processor converts the duration to the equivalent time span in seconds. The resulting sequence represents a range of timestamps in Unix time (seconds from epoch).

You can supply the following unit strings (case-insensitive):

Seconds: s sec secs second seconds
Minutes: m min mins minute minutes
Hours: h hr hrs hour hours
Days: d day days
Weeks: w week weeks
Months: mon month months
Years: y yr yrs year years

MVSORT

MVSORT(mv)

Sorts the elements of a multi-value field mv in alphabetical order.

MVZIP

MVZIP(mv1, mv2[, delim])

Splits each multi-value field by the pipe delimiter |, pairs elements from each field, and returns the multi-value field of joined elements. Optionally specify a delimiter of one or more characters to join elements, otherwise defaults to comma (,). If mv1 and mv2 are different lengths, the function stops at the shorter field and drops remaining elements from the longer one.

NULL

NULL()

Returns a null value, equivalent to a missing attribute. Useful as a fallback in IF, CASE, or COALESCE. Ensure you include the parentheses when calling NULL(); you can't refer to literal NULL.

The following expressions return null in Lumi:

NULL() == NULL()
NULL() + 5
LIKE(NULL(), 'abc')

Example

Assigns source from srcip if it exists.

Expression: IF(ISNOTNULL(srcip), srcip, NULL())

Event input: {"dstip": "172.16.200.2"}

Expression output: source not created

NULLIF

NULLIF(a, b)

Returns either a null value or the argument a:

Null if a exists and a=b
Null if a doesn't exist
a if it exists and a!=b
a if it exists and b is null

Comparison is numeric when possible, lexicographic otherwise.

Example

Assigns source from srcip if it exists.

Expression: NULLIF(srcip, "")

Event input: {"dstip": "172.16.200.2"}

Expression output: source not created

POW

POW(base, exp)

Raises base to the power of exp.

REPLACE

REPLACE(s, pattern, replacement)

For string literal s, finds regex pattern and replaces all matches with replacement.

Example

Assigns formatted_date after formatting a date from YYYY-MM-DD to MM/DD/YYYY.

Expression: REPLACE(raw_date, "(\d{4})-(\d{2})-(\d{2})", "$2/$3/$1")

Event input: {"raw_date": "2026-03-13"}

Expression output: formatted_date: 03/13/2026

ROUND

ROUND(n[, precision])

For numeric literal n, rounds to the nearest integer or, if specified, to precision number of decimal places. Numbers halfway between two integers round up; for example, 4.5 rounds to 5.

Example

Assigns price normalized to two decimal places.

Expression: ROUND(price, 2)

Event input: {"price": 934.49032}

Expression output: price: 934.49

RTRIM

RTRIM(s)

For string literal s, removes trailing whitespace.

Example

Assigns sku from a product code without trailing spaces.

Expression: RTRIM(sku)

Event input: {"sku": "SKU001 "}

Expression output: sku: SKU001

SPLIT

SPLIT(s, delim)

Splits string s on delimiter delim and returns the parts as a multi-value field. Returns null if either argument is null or if delim is an empty string.

STARTS_WITH

STARTS_WITH(s, prefix)

Returns true if string literal s starts with prefix, false otherwise, or null if either argument is null.

SUBSTR

SUBSTR(s, start[, length])

Alias for SUBSTRING.

SUBSTRING

SUBSTRING(s, start[, length])

For string literal s, extracts a substring starting at one-based index start for an optional number of length characters. Aliased by SUBSTR.

For the start and length parameters:

A negative start extracts from the end of the string.
A start value of 0 or 1 with no length returns the entire string.
A start value of 0 with any length translates to the first position of the string. In other words SUBSTRING(s, 0, 4) is equivalent to SUBSTRING(s, 1, 4).
When no length is provided, the function extracts to the end of the string.

Example

Assigns filedate from the extracted part of a filename.

Expression: SUBSTRING(filename, 4,6)

Event input: {"filename": "app_260313_error.log"}

Expression output: file_date: 260313

TONUMBER

TONUMBER(s, radix)

Converts string s to a number using the numeric base radix.

Only works on strings that represent integers, such as "10". You can't supply decimal points, signs, or non-digit characters. The following are all invalid strings: "10.0", "-10", "ten".

If radix is 16, the processor automatically strips leading 0x or 0X from s if present.

TRIM

TRIM(s)

For string literal s, removes leading and trailing whitespace.

Example

Assigns city without leading or trailing spaces.

Expression: TRIM(city)

Event input: {"city": " New Orleans "}

Expression output: city: New Orleans

UPPER

UPPER(s)

For string literal s, converts to uppercase.

Example

Assigns state after normalizing its abbreviation to upper case.

Expression: UPPER(state)

Event input: {"state": "Ca"}

Expression output: state: CA

Learn more

For more information, see the following topics:

Manage pipelines and processors for details on creating a pipeline. Processors reference for details on processors.

How to try examples​

Operators​

Order of operations​

Truth tables​

CASE​

CEIL​

CEILING​

CIDRMATCH​

COALESCE​

CONCAT​

CONTAINS​

ENDS_WITH​

FLOOR​

IF​

IN​

ISNOTNULL​

ISNULL​

ISNUM​

LEN​

LENGTH​

LIKE​

LOWER​

LTRIM​

MATCH​

MV_TO_JSON_ARRAY​

MVAPPEND​

MVCOUNT​

MVDEDUP​

MVFILTER​

MVFIND​

MVINDEX​

MVJOIN​

MVMAP​

MVRANGE​

MVSORT​

MVZIP​

NULL​

NULLIF​

POW​

REPLACE​

ROUND​

RTRIM​

SPLIT​

STARTS_WITH​

SUBSTR​

SUBSTRING​

TONUMBER​

TRIM​

UPPER​

Learn more​

How to try examples

Operators

Order of operations

Truth tables

CASE

CEIL

CEILING

CIDRMATCH

COALESCE

CONCAT

CONTAINS

ENDS_WITH

FLOOR

IF

IN

ISNOTNULL

ISNULL

ISNUM

LEN

LENGTH

LIKE

LOWER

LTRIM

MATCH

MV_TO_JSON_ARRAY

MVAPPEND

MVCOUNT

MVDEDUP

MVFILTER

MVFIND

MVINDEX

MVJOIN

MVMAP

MVRANGE

MVSORT

MVZIP

NULL

NULLIF

POW

REPLACE

ROUND

RTRIM

SPLIT

STARTS_WITH

SUBSTR

SUBSTRING

TONUMBER

TRIM

UPPER

Learn more