Required arguments

Optional arguments

None

Should I use the repeat function or a dataset literal?

The repeat function is a very useful method to create a temporary dataset in certain circumstances.

An alternative to the repeat function is to use a dataset literal. See Dataset literals in the SPL2 Search Manual.

The following table describes the usage differences and limitations between the repeat function and a dataset literal:

1. Create a dataset with empty events

You can create a dataset of empty events. For example, to create a dataset with 5 events use this search:

FROM repeat({}, 5)

To add a timestamp to the events, use the eval command:

from repeat({},5)  
 | eval _time = now()

The results look something like this:

Each event has the exact same timestamp.

2. Create events with hourly or daily timestamps

There are many things you can do to extend the events you create.

For example, you can create a set of hourly timestamps instead of events with the exact same timestamp. Add the streamstats command to create a count of the events. Use the eval command to create incremental timestamps by multiplying the count by 3600, the number of seconds in an hour.

| FROM repeat({}, 5) 
| eval _time = now()
| streamstats count()
| eval _time=_time-(count*3600)

The results look something like this:

The hours in the timestamp are 1 hour apart, starting with the latest timestamp and ending with the earliest timestamp.

To create daily timestamps, use 86400, the number of seconds in a day, in the eval command.

3. Create events using a JSON object

You can specify a JSON object to create multiple fields in one or more events.

| from repeat({name: "Alex Martin", age: 25, 'city-name': "San Francisco"},2)

Because the field city-name contains a dash ( - ), the name must be enclosed in single quotation marks. The value San Francisco is a string, which must be enclosed in double quotation marks.

The results look something like this:

4. Create events with multiple fields

This example shows how to specify multiple key-value pairs in a JSON object, which results in multiple, duplicate fields in each event in the dataset.

| from repeat({host: "www1", sourcetype: "access_combined"},3)
| eval _time = now()

The results look something like this:

You can alter the duplicate events by adding the streamstats command to create a count of the events. Use the eval command to alter an event by the count number.

For example, this search alters the value of the host field for the second event:

| from repeat({host: "www1", sourcetype: "access_combined_wcookie"},3) 
| eval _time = now()
| streamstats count() 
| eval host = if(count=2, "www2", host)

The results look something like this: