Calls the named function on a field over a set of events. The
result is returned in a field named
_function for the
selected function. This allows having the function name as a
dashboard parameter.
Click + next to an example below to get the full details.
Call Named Function on a Field - Example 1
Calls the named function (avg()) on a field over a set of events
Query
logscale
avg_sent:=callFunction("avg",field=bytes_sent)
Introduction
In this example, the callFunction() function is
used to find the average bytes sent in HTTP responses. It calls the
named function (avg()) on a field over a set of
events.
Step-by-Step
Starting with the source repository events.
logscale
avg_sent:=callFunction("avg",field=bytes_sent)
Finds the average bytes sent in HTTP response, and returns the results
in a new field named avg_sent.
Notice that the avg() function is used indirectly
in this example.
Event Result set.
Summary and Results
The query is used to find the average bytes sent in HTTP responses.
Using a query parameter (for example,
?function) to select the aggregation
function for a timeChart() is useful for dashboard
widgets.
Using callFunction() allow for using a function
based on the data or dashboard parameter instead of writing the query
directly.
Call Named Function on a Field - Example 2
Calls the named function (count()) on a field over a set of events
In this example, the callFunction() function is
used to call the named function (count()) on a
field over a set of events using the query parameter
?function.
Counts the events in the value
field, and displays the results in a timechart.
Notice how the query parameter
?function is used to select the
aggregation function for a timeChart().
Event Result set.
Summary and Results
The query is used to count events and chart them over time. Because we
are using callFunction(), it could be a different
function based on the dashboard parameter.
Using a query parameter (for example,
?function) to select the aggregation
function for a timeChart() is useful for dashboard
widgets.
Using callFunction() allow for using a function
based on the data or dashboard parameter instead of writing the query
directly.
