eval
Description
Performs various operations on the data.
Syntax
| eval <field>=<expression>["," <field>=<expression>]...
Required Arguments
| Parameter | Syntax | Description |
|---|---|---|
field | <string> | Name of the field with the result of the operation. |
expression | <expression> | Operation (calculation) or a set of operations (calculations) to be performed for the new field. |
Data Types
eval operates with the following basic data types and attempts to retain the original or assigned data type in the output:
stringnumericbooleannullmultivalue
info
multivalue represents arrays of values, where each element is one of the basic data types.
Examples
Example #1
source nix_events-* | eval res = if(errNo == -1, "OK", "NOTOK")