The name of the parameter followed by an equals sign = and the value to be provided. For example:

field=ipaddress

Multiple parameters can be specified, separated by a comma:

field=ipaddress,as=hostname

Function names must be immediately followed by an opening parentheses and must be closed with a closing parentheses. These are invalid

rdns (field=ipaddress,as=hostname)
rdns field=ipaddress,as=hostname
rdns(field=ipaddress,as=hostname

This is the correct format:

rdns(field=ipaddress,as=hostname)

Parameter Values

Values to parameters follow the formats and requirements as described in Datatypes in CQL. Pay attention to the format and requirements. For example, parameters that accept strings, arrays and numbers must be honoured. The flexibility of these values and implied conversions (for example strings to numbers or numbers to strings) also apply.

Optional and Required Parameters

Most parameters to functions are optional, and for many at least one parameters is required for the function to operate properly. For example there are four parameters to the sort(), and all of them are optional. For groupBy(), the field parameter is required.

Default Parameter Values

Many functions support one or more parameters that configure the operation of the function and for those functions, the default value and setting of the parameter applies unless it is explicitly overridden by explicitly setting the value. These default values always apply.

For example, the sort() uses a default setting for the order, type, and limit parameters. The effect is that the expression:

sort(name)

Is actually equivalent to the expression:

sort(name,order=desc,type=number,limit=200)

Care should therefore be taken when using the function without paying attention. For example, the sort() always sorts values in descending order unless the order parameter explicitly sets the value:

groupBy(host)
| sort()

The above sorts the host field in descending (Z-A) order. To sort in ascending order (A-Z):

groupBy(host)
| sort(order=asc)

These default values are implied for each function and set the operation.

Common Parameter Names

Across all of the different functions, many parameters have common names and therefore common behaviors. These include (but are not limited to):

Output Parameters

Some functions process the input events and then apply the result to a new field in the output. Assignment of this new value in the event set can be achieved either through the as parameter to functions that support it, or through the use of the field assignment syntax. These two statements are identical:

upper(host,as=upperhost)

And:

upperhost := upper(host)

The output value in this instance can overwrite the original field, so to change the case of the field and put it back into the original field:

upper(host,as=host)

This simplifies the output (by reducing the number of fields in the events) and simplifying the methods for summarizing and processing).

Omitted Parameter Name

Some functions have a parameter that does not need to be specified for the corresponding parameter value to be applied to the function operation. For this parameter, there is no requirement to use the name. For example, for the sort() function the field parameter name can be omitted. So:

sort(hostname)

Is identical to:

sort(field=hostname)

The omission of the name also works when used with other parameters, so:

sort(hostname,order=asc)

Is identical to:

sort(field=hostname,order=asc)

Parameter omission can make some statements clearer and simpler but can also be confusing if you are not aware of the functionality.