Skip to content
Content was updated:Oct 1, 2024
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

## `test()`

Evaluates an arbitrary expression as a boolean value and filters events when the expression returns true. Not only can Falcon LogScale make comparisons between one field and one value, but it can also compare more fields and their respective values, using the `test()` function.

### Note

In `test()` unquoted strings are interpreted as field names.

Parameter | Type | Required | Default Value | Description
--- | --- | --- | --- | ---
`expression`[a] | expression | required |  | The expression to test.
[a] The parameter name `expression` can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

> Omitted Argument Names

> The argument name for `expression` can be omitted; the following forms of this function are equivalent:

> logscale Syntax

>     test("value")

> and:

> logscale Syntax

>     test(expression="value")

> These examples show basic structure only.

Hide negatable operation for this function

Show negatable operation for this function

> Negatable Function Operation

> This function is negatable, implying the inverse of the result. For example:

> logscale Syntax

>     !test()

> Or:

> logscale Syntax

>     not test()

> For more information, see Negating the Result of Filter Functions.

### `test()` Examples

Click + next to an example below to get the full details.

#### Check if Field Contains Specific Value

Check if field contains specific value using `test()` function

##### Query

logscale

    test(myField == "myValue")

##### Introduction

In this example, the `test()` function is used to check if a field contains a specific value.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       test(myField == "myValue")

   Returns all events where field myField holds the specific value myOtherField. Notice the use of double-quotes. If the string had been `test(myField == myOtherField)`, then it would have returned results where the fields contained the same values and not a specific value.

3. Event Result set.

##### Summary and Results

The query is used to check if a field contains a specific value. The function syntax with `test()` does not support fields with space. For example, `test("f o o" == "bar")` compares the two values, not a field named f o o.

The syntax form, `myField = myValue` is the preferred method for performance reasons.

#### Check if Fields Contain Same Value

Search for more fields with same length using the test() function with length()

##### Query

logscale

    test(length(userid) == length(method))

##### Introduction

In this example, the `test()` function is used with `length()` to search for events where the userid field and method field have the same length.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       test(length(userid) == length(method))

   Returns all events where field userid has the same length as the method field. This could for example be events with `Chad` and `POST`, and `Peter` and `PATCH`.

3. Event Result set.

##### Summary and Results

The query is used to compare more fields and their respective values.

#### Compare More Fields and Filter for Specific Events

Compare more fields and filter for events that are not twice as large using a negation statement

##### Query

logscale

    test(field1 != 2 * field2)

##### Introduction

In this example, the `test()` function is used to filter for events where the value of field1 is not exactly twice as large as the value in field2.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       test(field1 != 2 * field2)

   Filters for events where the value of the field field1 is not exactly twice as large as the value in field field2.

3. Event Result set.

##### Summary and Results

The query is used to compare more fields and filter for specific events that are not of a certain size.

#### Compare More Fields and Their Respective Values

Compare more fields and their respective values

##### Query

logscale

    test(field1 < field2)

##### Introduction

In this example, the `test()` function is used to check if the value of field1 is less than the value in field2.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       test(field1 < field2)

   Evaluates if the value of the field field1 is less than the value in field field2.

3. Event Result set.

##### Summary and Results

The query is used to compare more fields and their respective values.

#### Evaluate Arbitrary Expression as Boolean Value

Evaluate an arbitrary expression as a boolean value and filter events when expression returns true

##### Query

logscale

    test(foo < bar)

##### Introduction

In this example, the `test()` function evaluates the arbitrary expression `<` as a boolean value (true/false) and filters events when the expression returns true.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       test(foo < bar)

   Evaluates if the value of the field foo is less than the value of the field bar.

3. Event Result set.

##### Summary and Results

The query is used to evaluate arbitrary expressions as boolean values in a query. This is used to filter events where the expression returns true. The difference between using the `test()` function instead of the `match()` function is that `test()` returns a boolean value and `match()` returns a string.

#### Evaluate Arbitrary Field Values for CPU Time Within Repository

Evaluate and compare field values for CPU time within a repository

##### Query

logscale

    test(cputime < 7500)

##### Introduction

In this example, the `test()` function evaluates the arbitrary expression `<` as a boolean value (true/false) and filters events when the expression returns true.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       test(cputime < 7500)

   Evaluates if the value of the field cputime is less than the value `7500` in a repository.

3. Event Result set.

##### Summary and Results

The query is used to evaluate arbitrary expressions as boolean values in a query. This is used to filter events where the expression returns true. The difference between using the `test()` function instead of the `match()` function is that `test()` returns a boolean value and `match()` returns a string. Searching for CPU times is useful when troubleshooting performance issues in a system.

#### Evaluate Field Values Within Repository

Compare field values within the Falcon LogScale repository

##### Query

logscale

    test(cputime < 7500)

##### Introduction

In this example, the `test()` function evaluates the arbitrary expression `<` as a boolean value (true/false) and filters events when the expression returns true.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       test(cputime < 7500)

   Evaluates if the value of the field cputime is less than `7500`.

3. Event Result set.

##### Summary and Results

The query is used to compare a field value within the Falcon LogScale repository.

#### Enter search term