Data types in Devo
When raw data arrives to Devo and is grouped into tables, each row represents an event and each column represents a different type of data. Devo automatically assigns one of its recognized data types to each column. To check a column data type in the query window, select the Search column layout option in the toolbar.
When performing query operations such as applying filters or creating new columns, you must take into account the data types of the columns you add as arguments, since each function requires specific types of data.
For example, say you want to get the regions corresponding to a set of IP addresses. You must create a new column using the Geolocated Region Name operation, and add an Ip type column as an argument. The created column will return the corresponding regions as sentences of characters (String data type).
The following table describes the available data types in Devo:
| Data type | Description | Example |
|---|---|---|
| str | The string data type represents a sequence of characters. | "Hello user 25", "user@company.com"... |
| int | The integer data type represents mathematical integers, that is, numbers that can be zero, positive or negative values but no decimal values. | 21, 0, -4... |
| float | The float data type represents a decimal (floating-point) number. | 3.25907, 5.542... |
| boxar(int1) | The boxar(int1) data type represents a byte array in the form of an hexadecimal string. | 41, 616263... |
| boolean | The boolean data type represents the values true and false. | true, false |
| duration | The duration data type represents an amount of time that must be an integer number followed by a suffix: d (for days), h (for hours), m (for minutes) and s (for seconds). Milliseconds have no suffix and are simply represented with the corresponding integer number. | 1d, 20m, 340... |
| timestamp | The timestamp data type represents a date in 'yyyy-MM-dd HH:mm:ss.SSS' format. | 2019-02-06 08:58:51.230 |
| geocoord | The geocoord data type represents a valid geocoord, which may be either a set of sexagesimal coordinates based on latitude and longitude values (latlon), or a hash representation of coordinates (geohash). | 40°24'46.3"N 3°41'43.8"W, ezjmguvj... |
| ip | The ip data type represents IPv4 addresses in dot-decimal notation. | 43.92.193.15 |
| ip6 | The ip6 data type represents IPv6 addresses. | 2001:0db8:85a3:0000:0000:8a2e:0370:7334 |
| net4 | The net4 data type represents an IPv4 network in x.x.x.x/s format. | 0.0.0.0/8 |
| net6 | The net6 data type represents an IPv6 network in x:x:x:x:x:x/s format. | 2001:db8:abcd:12::/64 |
| regexp | The regexp data type represents a regular expression. | [^\w] |
| template | The template data type represents a substitution string and is required as an input argument for the Substitute and Substitute all operations. The Template (template) operation outputs values in this data type. | ***, \1 |
| dc | The distinct count data type represents an estimated count of distinct elements in a data stream. The HyperLogLog++ Count Estimation (hllppcount), and HyperLogLog++ unpack (unpackhllpp) aggregation operations output values in this data type. The HyperLogLog++, Approximated estimation, and HyperLogLog++ pack (pack) operations require this data type as input. | 2.00000005960464 |
image | The image data type represents a Base64 encoded image. The To image (image) operation processes a Base64 enconded string and outputs its results in this data type. This data type is not required as input for any other operation. |
|
| mac | The mac data type represents a valid MAC address. | 00:0a:95:9d:68:16 |
| namepattern | The namepattern data type represents a part of a table name that can be used as a wildcard to filter sets of names in set(name) format using the Any name matches (anymatches) operation. You can transform strings to name patterns using the Glob pattern on names (nameglob) operation. | my.app, demo... |
| set(name) | The set(name) data type represents a set of table names. You can only get a column with this type of data after performing a global search. You will see a column called tables that returns a list of tables that contain the terms you looked for. | my.app.test, my.app.test2, demo.ecommerce.data... |
| json | This data type identifies content formatted in JSON syntax. This type is required as input for the Jq eval operation and is the output type for the jsonparse operation. json type columns cannot yet be used to define alerts, collections, data sources or injections, or be added as grouping keys when you group your data. This will be possible in future versions of the application. | {"id":3451,"first_name":"John","last_name":"Doe","email":"john.doe@devo.com"} |
| jq | This data type identifies a jq filter which is required as input for the Jq eval operation. This data type is created using the Jq filter compile operation. jq is a command-line JSON processor. Learn more here. |
