Devo LINQ, query language syntax Cheat Sheet

by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

Structure keywords Structure keywords (cont)

from Point to a table for the query. Specify a table decode switch​/case equivalent clause to set condit​ionally column
name using tags. values:
from my.app.we​b.auth decode(column, checkV​alue, value,​[ch​‐

where Where clause to filter results. eck​Value2, value2])

where [filter1 expres​sion], Each pair of arguments [check​Value,
[filter2 expression] value] is equivalent to a case sentence of
String values in expres​sions a switch statement.
have to be surrounded by double decode(statu​sCode, 200, "​Suc​ces​s",
quotes, single quotes are not 400, "Not Found", 406, "​Err​or", 404, "​‐
allowed. Err​or") as status​Cod​eDesc

select Add column to result set: nvl Null-C​oal​escing operator. Allow to set an alternate value
select source​_column or column when input value is null.

operation as destination_column nvl(column, altern​ate​_va​lue​_wh​en_​null)`

select uriHos​t(uri) as host

Aggreg​ation functions and operators
group every / by Group clause with an optional server and client
aggreg​ation period filter: avg Returns the average of a range of values [avg] or only
group [every server​_pe​riod] by
[ over not null values [nnavg] of the results on each

column] group:
avg(column); nnavg(column)
[every client_period]
group by statusCode count Returns the count of results on each group:
group every 10m count([column])
group every 10m by statusCode With argument, include only not null
every 1m entries in the count.

every Client aggreg​ation filter: first / nnfirst Returns the first or the not null first entry of the results
every period on each group:

Period syntax: an integer number first(column); nnfirst(column)

follow by a symbol indicating the

time period:[s:sec​onds, m:minutes,
h:hours, d:days, no suffix​:mi​lli​‐
sec​onds]
every 0 means no client period.
every 5m by serverIp

ifthenelse if/the​n/else equivalent clause to set condit​ionally

column values:
ifthenelse(condi​tion, errorV​‐
alue, succes​sValue )
select ifthenelse(statu​sCode !=
200,"Er​ror​"​,"Su​cce​ss") as
status​Cod​eDesc

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 1 of 8. https://readable.com
 Devo LINQ, query language syntax Cheat Sheet
by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

Aggreg​ation functions and operators (cont) Aggreg​ation functions and operators (cont)

last / nnlast Returns the last or the not null last entry of the ustddev / nnustddev Returns the unbiased standard deviation
results on each group: [ustddev] of the values or not null values
last(column); nnlast(column) [unnst​ddev] of the results on each group:

max / min Returns the maximum or the minimum value for ustdde​v/u​nns​tddev
(column)

the columns provided, on each group: Unbiased

max/min(col1, [col2], [col3]…) var / nnvar Returns the biased variance [var] of the
median Returns the statis​tical median for a column on values or not null values [nnvar] of the results
each group: on each group:
median(column) var/nnvar(column)

Restricted to columns of integer Biased

type uvar / nnuvar Returns the unbiased variance [uvar] of the

sum Returns the sum of the results on each group: values or not null values [unnvar] of the

sum(column) results on each group:

uvar/u​nnvar
(column)
sum2 Returns the sum of the squares of the results on
Unbiased
each group:
sum2(column) hllpp Returns the estimated count of distinct values
of the results on each group using the
percentile5 Returns the specific statistic percen​tileN , using
HyperL​ogLog++ algorithm:
percentile10 linear interp​ola​tion, of the results on each group:
hllpp(column)
percentile25 percen​tile[N]
(column)
Applies on DC (distinct count)
percentile75
data types.
percentile90
percentile95 hllppcount Returns the estimated count of distinct values
of the results on each group using the
stddev / nnstddev Returns the biased standard deviation [stddev]
HyperL​ogLog++ algorithm:
of the values or not null values [nnstddev] of the
hllppcount(column)
results on each group:
stddev​/nn​stddev
(column) Applies on float or integer

Biased data types.

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 2 of 8. https://readable.com
 Devo LINQ, query language syntax Cheat Sheet
by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

String operators and functions String operators and functions (cont)

has, [->] Case sensitive contains compar​ison. Using the operator replace Replaces only first occurrence of a string with a
-> only allows check one value: substitute string:
has(column, value1, [value2],…) replac​e(c​olumn, string​ToS​earch,
column -> value1 string​ToR​eplace)

weakhas Case insens​itive contains comparison: replaceall Replaces all occurr​ences of a search string with a
weakha​s(c​olumn, value) substitute string:

in, [<-] Case sensitive is contained compar​ison. Using the replac​eal​l(c​olumn, string​ToS​earch,

operator '<-' allows only one value: string​ToR​eplace)

 in(value1, [value​2],​[...], column) split Returns a specific piece of splitting operation by a
 value1 <- column separator:

weakin Case insens​itive is contained comparison:  pieceN​umber begin at 0.

weakin​(value, column) split(​column, separa​tor​String,

pieceN​umber)
startswith Returns strings that start with specific value:
starts​wit​h(c​olumn, value) splitre Returns a specific piece of splitting operation by a
regular expression:
endswith Returns strings that end with a specific value:
 pieceN​umber begin at 0.
endswi​th(​column, value)
splitr​e(c​olumn, re(string) or regexp,
toktains Specia​lized contains function for ASCII delimited tokens:
pieceN​umber)
toktai​ns(​column, value, [bool_​left],
substring Returns a substring beginning at specific index with the
[bool_​right])
provided length:
length Returns the length of a string value:
substr​ing​(co​lumn, index, length)
length​(co​lumn)
subs Returns a string replacing first substring occurrence
locate Returns the position of a substring, indexOf function:
based on a regular expression using a template string
locate​(co​lumn, substr​ing​_to​Locate)
as substi​tution value:
lower Returns the transf​orm​ation to lower case:  FailValue is returned when is provided
lower(​column) and no occurr​ences found
upper Returns the transf​orm​ation to upper case:  subs(c​olumn, regexp, template,
upper(​column) [failValue])
 subs(c​olumn, re(str​ing), templa​‐
te(​str​ing), [failV​alue])

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 3 of 8. https://readable.com
 Devo LINQ, query language syntax Cheat Sheet
by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

String operators and functions (cont) String operators and functions (cont)

subsall Returns a string replacing all substring occurr​ences damerau Returns Damerau distance:
based on a regular expression using a template damera​u(c​olumn, value)
string as substi​tution value: hamming Returns Hamming distance:
 FailValue is returned when is hammin​g(c​olumn, value)
provided and no occurr​ences found
levenshtein Returns Levenstein distance:
 subs(c​olumn, regexp, template,
levens​hte​in(​column, value)
[failValue])
osa Returns osa distance:
 subs(c​olumn, re(str​ing), templa​‐
osa(co​lumn, value)
te(​str​ing), [failV​alue])
publicsuffix Returns the main public suffix of a hostname:
trim Returns the result of trimming both sides:
publicsuffix(hostnameColumn))
trim(c​olumn)
 'www.m​y.s​ite.co.uk' = 'co.uk'
ltrim Returns the result of trimming left side:
rootdomain Returns the root domain of a hostname part of an
ltrim(​column)
url:
rtrim Returns the result of trimming right side:
rootdomain(hostnameUrlColumn)
rtrim(​column)
 'www.m​y.s​ite.com' = 'site'
matches, [~] Matches function that finds occurr​ences in a column
rootprefix Returns the root prefix of a hostname part of an url:
using a regular expression:
rootpredix(hostnameUrlColumn))
 matche​s(c​olumn, re(string) or
 'www.m​y.s​ite.com' = 'www.m​‐
regexp value)
y.site'
 column ~ re(string) or regexp value
rootsuffix Returns the root suffix of a hostname part of an url:
peek Returns the part of a string based on a regular
rootsuffix(hostnameUrlColumn))
expres​sion, optionally indicating a specific part
 'www.m​y.s​ite.com' = 'my.si​‐
occurrence:
te.com'
 If no partNumber is provided then
returns first part occurrence. subdomain Returns the subdomain of a hostname part of an
url:
peek(column, re(string) or regexp,
subdomain(hostnameUrlColumn)
[partN​umber])
 'www.m​y.s​ite.com' = 'www'
formatnumber Format a number with a specific mask and locale:
topleveldomain Returns the top level domain of a hostname part of
format​num​ber​(nu​mbe​rCo​lumn, mask,
an url::
locale)
topleveldomain(hostnameUrlColumn)
format​num​ber​(to​tal​Amount, "​‐
 'www.m​y.s​ite.co.uk' = 'uk'
###.##​", "​en-​GB")
shannonentropy

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 4 of 8. https://readable.com
 Devo LINQ, query language syntax Cheat Sheet
by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

Crypto​graphic functions Meta functions

md5 pragma​value
sha1 tablename
sha256
Data Types
sha512
str String
Web functions int Integer number: 1,58,12598
urischeme float Floating point number:24.256
urihost boolean Boolean: true, false
uriport timestamp Timestamp date in format: yyyy-MM-dd HH:mm:​‐
uripath ss.SSS
urifragment boxar(int) Byte array in hexade​cimal string format
uriquery duration Amount of time: an integer following by a letter
uriuser [d]ays, [h]ours, [m]inutes, [s]econds,
[No suffix​]:m​ill​ise​conds
urissp
uriauthority geocord Geographic coordi​nates set:
 Latitu​de/​lon​gitude sexage​simal
absoluteuri
values: 40º24'N 3º41'W
opaqueuri
 Hash repres​ent​ation of coordi​‐
urldecode nates (geohash)
uaurl ip IPv4 address format:  192.16​8.5.56
uaname
ip6 IPv6 address format:  2001:0​db8​:85​a3:​‐
uatype 000​0:0​000​:8a​2e:​037​0:7334
uaversion net4 IPv4 address in format: {x.x.x.x/0
uaicon net6 IPv6 address in format: x.x.x.x.x.x/s
uarobot
regexp Regular expres​sion:  [^\w]
uainfourl
template Represents a substi​tution string mask.
uafamily
dc Represents a estimated count of distinct elements in
uacompany a data stream.
uacompanyurl image Image as Base64 encoding image.
uadeviceicon mac MAC address in format:  00:0a:​95:​9d:​‐
uadeviceinfourl 68:16
uadevicetype namepa​ttern Represents a part of a table name:  my.app,
uaosurl demo, ...

uaosname set(name) Represents a set of table names:  {my.ap​‐

uaosicon p.test, my.app.test2}

uaosfamily json String in json format:  {"id​"​:345, "​nam​‐

e":"J​ohn​"}
uaoscompany
uaoscompanyurl
uaosversion Possible missing function to filter by OS version.

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 5 of 8. https://readable.com
 Devo LINQ, query language syntax Cheat Sheet
by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

Data Types (cont) JSON related functions

jq Represents a jq filter, jq is a command line json processor. jqeval

 .email label
jsonparse
Common comparison functions and operators

eq, [=] Equals to function and operator: Math functions and operators
 eq(column, value or column)
abs
 column1 = value or column
add / [+]
eqic Case insens​itive Equals to function:
sub / [-]
eqic(c​olumn, value or column)
mul / [*]
ge, [>=] Greater or equal function and operator:
div / [\]
 ge(column, value or column)
 column >= value or column rdiv / [/] Real division function and operator:

gt, [>] Greater than function and operator: mod / [%%] Module function:
 gt(column, value or column) rem / [%] Return the remain of a division operation:
 column > value or column pow Power function:
le, [<=] Less or equal function and operator: cbrt Cube root function:
 le(column, value or column)
sqrt Square root function:
 column <= value or column
ceil
lt, [<] Less than function and operator:
floor
 lt(column, value or column)
round
 column < value or column
signum
ne, [/=] Not equal function and operator:
 ne(column, value or column)
Statis​tical and specia​lised statis​tical functions
 column /= value or column
estimation
isnull Check if is null function:
isnull​(co​lumn) pack

isnotnull Check if is not null function: unpack​hllpp

isnotn​ull​(co​lumn)
Network functions

Logig Functions ispublic

and isprivate

or ipip4

not ipprotocol
purpose
host
routing
httpstatusdescription
httpst​atu​stype
reputation
score
sbl

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 6 of 8. https://readable.com
 Devo LINQ, query language syntax Cheat Sheet
by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

Conversion functions Special comparison functions (cont)

int anymatches Find occurr​ences in a set of names type column

str against a namepattern:
anymat​che​s(s​etO​fNames, namegl​ob(​‐
bool
string) or namepattern)
float
 anymat​che​s(t​ables, namegl​ob(​"​‐
image my.a​pp.*.*​"))
ip4
nameglob Return a formmated string as a namepa​ttern to use
net4 with anymatches:
ip6 namegl​ob(​string)

net6
Date and time functions
mac
day
to16
dayofweek
from16
dayofyear
to64
month
from64
year
toutf8
epoch
fromutf8
hour
toz85
minute
fromz85
second
compatible
millis​econd
mapped
today
translated
tomorrow
template
yesterday
timestamp
period
duration
re
Packet functions
parsedate
hasio4
formatdate
hastcp
humansize
hasudp
mkboxar
hasether

Special comparison functions ip4proto

ip4src
matches Matches function finds occurr​ences in a column using a
regular expression: ip4dst
 matche​s(c​olumn, re(string) or regexp ip4status
value) ip4ttl
 column ~ re(string) or regexp value
ip4len
ip4payload
ip4flags

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 7 of 8. https://readable.com
 Devo LINQ, query language syntax Cheat Sheet
by Rafa Hernández (elpluto) via cheatography.com/46990/cs/21055/

Packet functions (cont)

ip4fragment
ip4cs
ip4hl
ip4ds
ip4ecn
ip4tos
etherdst
ethersrc
etherpayload
etherstatus
ethertag
ethertype
tcpdst
tcpsrc
tcpstatus
tcpflags
tcppack
tcpcs
tcpseq
tcphl
tcppayload
tcpurg
tcpwin
udpsrc
udpport
udpstatus
udpcs
udplen
udppayload

By Rafa Hernández (elpluto) Published 2nd January, 2023. Sponsored by Readable.com

cheatography.com/elpluto/ Last updated 2nd January, 2023. Measure your website readability!
Page 8 of 8. https://readable.com