When a query statement or expression modifies event data, for example extracting data, adding new fields, or updating the value of an existing field, the operation updates every event in the event set. This is because the query pipeline performs that same function on every event in the set of events.

For example, consider the following simulated set of events. If a new field is added through the query, each event will now have the new field. Here is the original event set:

Here a new field is added via a query:

username := "Bob"

Which leads to the following result, where each event now has a new field:

Existing data can also be modified or updated. CQL allows for all fields to be updated or modified in the stream of events, overwriting the original values. For example, this can be performed with an assignment expression, which updates every event. Here is the expression:

host := "internal"

Here is the updated list of values:

The process also works for calculations. For example, here is an expression that creates values in seconds in place of milliseconds:

cpus := cpums/1000

Which produces values that look like the following:

Processing individual events can be useful when modifying or updating data before aggregation, or summarizing to format information into a suitable format, either for aggregation or identifying or unifying information.