Skip to main content
Use this page to look up expression syntax in Sift. Expressions are written using Common Expression Language (CEL) and are used in Calculated Channels, Rules, and User-Defined Functions.

Channel references

Each input Channel selected when configuring a Rule, Calculated Channel, or User-Defined Function is automatically assigned a shorthand variable based on selection order: $1, $2, $3, and so on. Use these variables to reference the corresponding Channel in your expression.

Operators

The following table lists the CEL operators supported in Sift. Not all CEL operators are supported.

Functions

The Expression Syntax panel in the expression editor organizes functions into the following sections:

Stateful functions

Stateful functions compute values using data from preceding rows within a rolling time window of up to 10 minutes. Use them to track trends, detect gradual changes, and compute time-based metrics across telemetry data. The following table lists all available stateful functions with expanded descriptions to help you choose the right function for your use case.

User-Defined Functions

The User-Defined Functions section of the expression editor lists all named, reusable functions created across your organization. Call any function by name directly in your expression.

Behavior

The following table describes known constraints and behaviors to be aware of when writing expressions in Sift.