Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands.

The cluster label is generated by using a clustering algorithm. The similarity of the events is determined by comparing the values in a specific field.

The following table defines the parameters you can use with the cluster function:

You can use this function with the eval and where commands, in the WHERE and SELECT clauses of the from command, and as part of evaluation expressions with other commands.

Examples

The following example clusters the events by the values in the _raw field. The events are then sorted by the cluster number.

... | eval cluster_number = cluster(_raw) | sort - cluster_number

This example is similar to the previous example, but uses the cluster function in the SELECT clause of the from command:

from main select _raw, cluster(_raw) orderby cluster_number

The following example clusters the events by the values in the _raw field using a threshold of 0.9F . The events are then sorted by the cluster_label field.

... | eval cluster_label = cluster(_raw, cluster_threshold:0.9F) | sort cluster_label

Consider this set of events:

The results look like this:

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands.

The filter parameter is optional. When specified, the filter populates the array with only the field names that match the filter. The filter can contain up to three wildcards. When wildcards are specified, a segment array is added to the JSON object that represents the field name segments which match each wildcard.

Examples

The following example shows the results when the getfields function is used on a set of columns. Consider this set of events:

The following search uses the getfields function without a filter:

... | eval rowData = getfields()

The results look like this:

The following example shows how to use a filter with the getfields function. Consider this set of events which contains information about the status of various servers:

The field names consist of three parts:

• The word status
• The name of the server, such as www1
• The location of the server, such as east1

You can use a filter with wildcards to return information only from these fields and collect the statuses of all of your servers. For example:

... | eval serverData = getfields('status_*_*')

The results look like this:

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isarray function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isarray function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example returns True because [1, 2, 3] is an array.

... | eval result = if(isarray("[1, 2, 3]"), "True", "False")

The following example returns False because 1 is not an array.

... | eval result = if(isarray(1), "True", "False")

Usage

Use this function with other functions that return Boolean data types, such as cidrmatch and mvfind.

This function cannot be used to determine if field values are "true" or "false" because field values are either string or number data types. Instead, use syntax such as <fieldname>=true OR <fieldname>=false to determine field values.

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isbool function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isbool function directly with both the where and eval commands.

Example

The following example shows how to use the where command to determine if the values in the encrypted field are Boolean values.

... | where isbool(encrypted)

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isdouble function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isdouble function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example returns True because 3.546 is a double.

... | eval result = if(isdouble(3.546), "True", "False")

The following example returns False because 1000000 is not a double.

... | eval result = if(isdouble(1000000), "True", "False")

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isint function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isint function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example shows how to use the isint function with the if function. This example evaluates whether the value of the product_id field is an integer. If the value of the product_id field is an integer, then the isint function returns TRUE and adds the value int in the result field.

... | eval result=if(isint(product_id),"int", "not int")

The following example shows how to use the isint function with the where command. This example determines if the value in the my_data field is an integer.

... | where isint(my_data)

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the ismv function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the ismv function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example returns True because the value in the number_list field is a multivalue.

... | eval number_list=split("1, 2, 3", ",")
| eval result=if(ismv(number_list), "True", "False")

The result looks like this:

Usage

This function is useful for checking for whether or not a field contains a value.

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isnotnull function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isnotnull function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example shows how to use the isnotnull function with the if function. This example evaluates whether the name field contains a value. If the name field is not empty, then the isnotnull function returns TRUE and adds the value yes in the result field.

... | eval result=if(isnotnull(name),"yes","no")

The following example shows how to use the isnotnull function with the where command. This example determines if the my_data field contains a value.

... | where isnotnull(my_data)

Usage

This function is useful for checking whether or not a field contains a value.

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isnull function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isnull function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example shows how to use the isnull function with the if function. This example evaluates whether the name field contains a value. If the name field is not empty, then the isnull function returns FALSE and adds the value no in the result field.

... | eval result=if(isnull(name),"yes","no")

The following example shows how to use the isnull function with the where command. This example determines if the my_data field contains a value.

... | where isnull(my_data)

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isnum function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isnum function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example shows how to use the isnum function with the if function. This example evaluates whether the value of the population field is a number. If the population field is a number, then the isnum function returns TRUE and adds the value yes in the result field.

... | eval result=if(isnum(population),"yes","no")

The following example shows how to use the isnum function with the where command. This example determines if the value in the my_data field is a number.

... | where isnum(my_data)

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isobject function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isobject function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example returns False because the value in the games field isn't a valid JSON object.

... | eval games = "Ticket to Ride, Settlers of Catan"
| eval result = if(isobject("games"), "True", "False")

The following example returns True because the value in the games field is a valid JSON object.

... | eval games = "{\"type\": \"competitive\", \"name\": \"Ticket to Ride\"}"
| eval result = if(isobject(games), "True", "False")

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. Because the function returns a Boolean value, it is supported differently in different product contexts:

• In searches, you can use the isstr function directly with the where command, but the eval command can't directly accept a Boolean value. You must specify the function inside another function, such as the if function, which can accept a Boolean value as input.
• In Edge Processor and Ingest Processor pipelines, the eval command is able to directly accept Boolean values, so you can use the isstr function directly with both the where and eval commands.

The <value> argument can be a field name or a value.

Examples

The following example shows how to use the isstr function with the if function. This example evaluates whether the value of the user_account field is a string. If the user_account field is a string, then the isstr function returns TRUE and adds the value yes in the result field.

... | eval result=if(isstr(user_account),"yes","no")

The following example shows how to use the isstr function with the where command. This example determines if the value in the my_data field is a string.

... | where isstr(my_data)

Usage

You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands.

Examples

The following example takes one argument and returns a string representation of its type. This example returns "NumberStringBoolInvalid"

... | eval n=typeof(12) + typeof("string") + typeof(1==2) + typeof(badfield)

from [{ }]

For example:

To determine the data type of the _time field, use the eval command with the typeof function. For example:

| from [{ }] 
| eval t=typeof(_time)

The results are: