Eval
Calculates an expression and puts the resulting value into the record as a new field.
- If the field name that you specify does not match a field in the data stream, a new top-level field is added to your record.
- If the field name that you specify matches a field name that already exists in the data stream, the results of the eval expression overwrite the values in that field.
You can chain multiple eval expressions in a single eval function using a semi-colon to separate subsequent expressions. The eval function processes multiple eval expressions in-order and lets you reference previously evaluated fields in subsequent expressions. See example 4 on this topic to see how to reference a previously evaluated field and how expressions are evaluated in order. This function accepts a variable number of arguments.
- Function Input
- collection<record<R>>
- This function takes in collections of records with schema R.
- Function Output
- collection<record<S>>
- This function outputs the same collection of records but with a different schema S.
Arguments
Argument | Input | Description |
---|---|---|
function | collection<expression<any>> | Any values and scalar functions that will be executed to determine the value to place in a new field. |
Unless assigned, new values are placed into a record under the field name field0
. Use the as
scalar function to rename the field in which new values are placed.
UI examples
1. Change sourcetype to wineventlog:
as("wineventlog", "sourcetype");
2. Create a new field that contains the value of host:
as(get("host"), "User");
3. Extract metrics data from body field:
as(extract-regex(cast(get("body"), "string"), /group=(?<group>S+),s?series="(?<series>[^"]+)",s?(?<data>.*)$/), "metrics");
4. Expressions get evaluated in order. In this example, x and y are both equal to 3:
as(3, "x"); as(get("x"), "y");
DSL examples
1. Change sourcetype to wineventlog:
eval(input, as("wineventlog", "sourcetype"));
2.Create a new field that contains the value of host:
eval(input, as(get("host"), "User"0);
3. Extract metrics data from body field:
eval(input, as(extract-regex(cast(get("body"), "string"), /group=(?<group>S+),s?series="(?<series>[^"]+)",s?(?<data>.*)$/), "metrics"0);
4. Expressions get evaluated in order. In this example, x and y are both equal to 3:
eval(input, as(3, "x"); as(get("x"), "y"));
Drop Fields | Extract Timestamp |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.1
Feedback submitted, thanks!