Event Modifying Functions

Functions that modify each event in the event set; for example adding a field, or modifying/updating the value of a field in each event.

For example, given the input data:

The query:

upper(user,as=upperuser)

Creates a new field, upperuser:

When modifying events in this way all of the event data and fields for each event is retained.

Event Creation Functions

Functions that add new events to the event set, or that remove events from the event set. This has the affect of changing the list of events in each set. For example, using split() to split an array duplicates the original event for each element of the array. So with this input data (where each is row is an event):

Shows three events, and using:

split(permlist)

Now with a result set of seven events. The original list of events has been updated with the new set, similar to aggregation, but with similar information.

Other functions that perform this creation of events that may be similar to (or completely replace) the original set include defineTable(), join functions, including join(), and readFile().

Event Set Modifying Functions

Functions that replace the incoming event set with a new set of events and fields; most often this is due to an aggregation, but it might also be functions that create new events such as copyEvent() or remove events such as dropEvent(), or joins where new events are composed based combination of two or more events.

With groupBy() for example, the input data:

The events and fields are completely replaced with the aggregated dataset: