Types of expressions

Expressions are widely used in the Search Processing Language (SPL). Expressions produce a value and can be composed of literals, functions, fields, parameters, comparisons, and other expressions. You can use expressions with the following commands:

  • In an eval expression using the eval command to calculate or construct new values. For example: 
    ...| eval diameter=circumference*3.14
  • In a filter using the where command. For example: 
    ... | where status in("400", "401", "403", "404")
  • In an eval expression using the fieldformat command to change the appearance of a field value in the search results. For example: 
    ... | fieldformat count=tostring(count, "commas")

You can combine literals or constants, variables such as fields, navigations or parameters, operators and functions to create expressions that can be used to fabricate new values or predicate expressions.

Expressions quick reference

The following table describes the type of expressions that you can use with SPL:

Expression type Description Examples Output
String literal A regular string value. String values must be enclosed in double quotation marks. 
"surname"
"C:\\windows"
"C:\\windows\temp"
 
surname
C:\windows
C:\windows   emp
The \t in the path is interpreted as a tab. To avoid this you must escape the backslash. For example: 
"C:\\windows\\temp"
Boolean literal A Boolean value. The only valid Boolean values are true and false. 
true
false
 
true
false
Number literal A number value or a numeric expression. 
2048
5-4
 
2048
1
Null literal A null value is the intentional absence of any object value. You can use a null literal to set a field to null, which removes the field. 
null
Field The name of a field in your data.

Field names cannot contain square brackets [ ]. 

client_ip
port
'5minutes'
'status-code'
avg(bytes/1024)
 When a field name is included in an expression, the field values are used when the expression is resolved.

The field name bytes is part of this binary expression.

Assignment Uses the equal sign ( = ) to assign the results of an <expression> to a <field>. If the field exists in the incoming search results, the values in that field are replaced. Otherwise a field is created in the outgoing search results.

The syntax is:
<field>=<expression> 

speed=distance/time
'low-category' = lower(categoryId)
 
speed=65
'low-category' = arcade
Function A function call with one or more expressions.

The syntax is:
function_name ( <expression> [, <expression> ]... ) 

avg(size)
case(status = 200, "OK", status = 404, "Not found", status = 500, "Internal Server Error")
 When a function is included in an expression, the results of the function are used when the expression is resolved.
Unary An operation with only one argument. Primarily used with unary minus to change the sign of its argument. A positive number becomes a negative, and a negative number becomes a positive. Use a space between the sign and the argument.

The syntax is: [ + | - ] <expression> 

- discount_amount
- (.20)
 
-discount_amount
-.20
Binary An operation with two arguments. A common binary expression is a + b, which is the addition operator ( + ) surrounded by two arguments, or operands.

The syntax is:
<expression> <binary-operator> <expression>

Valid binary operators are:
addition ( + )
subtraction ( - )
division ( / )
multiplication ( * )
percent ( % )
concatenation ( + )

 
5 + 12
bytes/1024
surname.", ".firstname
 When a binary operation is included in an expression, the results of the operation are used when the expression is resolved.