In this example, upper() and lower() functions are used with concat() to concatenate two fields containing error messages, where one field's result is all lower case letters and the other field's results are all upper case letters.

If no as parameter is set, the fields outputted to is by default named _upper and _lower, respectively.

In this query, the as parameter is used for the lower() and upper() functions to label their results. These fields (msg1 and msg2) are then used with the concat() function, returning the concatenated string into a field named test.

The query is used to either convert strings to lower case or upper case and return the new concatenated strings/results in a new field. In this example, concatenating error messages.

The specific labeling of msg1 and msg2 is particularly useful when you have more than one field that use the same query function.

By converting fields to consistent cases, it helps standardize data for easier analysis and comparison. The concatenation allows you to combine multiple fields into a single field, which can be useful for creating unique identifiers or grouping related information.

In this example, the array:eval() function is used to convert all values (for example [Thermostat, Smart Light]) in an array devices[] from lowercase to uppercase and show the results in a new array.

Example incoming data might look like this:

The query is used to turn values in an array into uppercase. The array:eval() function can also be used for squaring a list of numbers in an array.

Sample output from the incoming example data:

Standardizing the format of fields is useful for consistent analysis. In this example, upper() and lower() functions are used with concat() to concatenate the fields #category and severity, where one field's result is all lower case letters and the other field's results are all upper case letters.

If no as parameter is set, the fields outputted to is by default named _upper and _lower, respectively.

In this query, the as parameter is used for the lower() and upper() functions to label their results. These output fields (category and severity) are then used with the concat() function, returning the concatenated string into a field named test. Finally, it uses the top() function, to show which combinations of severity and category are most common in the data.

The query is used to standardize the format of the values in the fields #category and severity and concatenate the values into a single field, showing which combinations of severity and category are most common in the data.

The specific labeling of category and severity is particularly useful when you have more than one field that use the same query function.

By converting fields to consistent cases, it helps standardize data for easier analysis and comparison. The concatenation allows you to combine multiple fields into a single field, which can be useful for creating unique identifiers or grouping related information. It provides a quick overview of the distribution of events across different severity-category combinations.

Sample output from the incoming example data (showing the first 10 rows only):

Notice how the value of #severity is in lower case letters, and the value of #category is in upper case letters.