Creates a field with the name of the parameter field setting its value to value. If the field already exists on an event the field keeps its existing value.

ParameterTypeRequiredDefault ValueDescription
fieldstring or arrayrequired   The field or fields to set the default value for. An array of multiple field names can be passed to this parameter.
replaceEmptybooleanoptional[a] false If the field's value is the empty string, override the value with the default.
value[b]stringrequired   Default value to assign to field, if not already set.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name value can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

default() Examples

Click + next to an example below to get the full details.

Set Default Values for Fields - Example 1

Set default values for field using the default() function so it can be used in a calculation with eval()

Query
logscale
default(field=[minutes, seconds, hours], 0)
Introduction

Setting default values of fields is necessary, if the fields are to be used in calculations with the eval() function. If not set to a value so the field is considered to be present, the event would be discarded during eval step. In this example, an array is set as the field parameter. This allows setting the same default value for multiple fields with a single command.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    default(field=[minutes, seconds, hours], 0)

    Sets the default value of the fields minutes, seconds and hours to 0 so it can be used in a calculation. It ensures, that all time-related fields have a numeric value.

    If the fields did not have a value, the event would be discarded during the eval step because eval() requires all used fields to be present.

  3. Event Result set.

Summary and Results

The query is used to enable calculation of the fields with the eval() function. The query ensures that all events have consistent minutes, seconds, and hours fields for further processing or analysis. Otherwise, if the field is not set to a value, the event is not parsed. The use of the default() function is important for data normalization and preparation in log analysis, ensuring consistent and complete data sets for further processing and analysis. For example, in a security event log, ensuring that all events have a message can be crucial for quick triage.

Set Default Values for Fields - Example 2

Set default values for field using the default() function so it can be used in a calculation with eval()

Query
logscale
default(field=[url, uri, link], "localhost")
Introduction

Setting default values of fields is necessary, if the fields are to be used in calculations with the eval() function. If not set to a value so the field is considered to be present, the event would be discarded during eval step because eval() requires all used fields to be present. In this example, an array is set as the field parameter. This allows setting the same default value for multiple fields with a single command.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    default(field=[url, uri, link], "localhost")

    Sets the default value of the fields url, uri and link in an array to localhost. It ensures, that URL-related fields always have a value.

  3. Event Result set.

Summary and Results

The query is used to enable calculation of the fields with the eval() function. The query ensures that all events will have consistent url, uri, and link fields for further processing or analysis. Otherwise, if the field is not set to a value, the event is not parsed. The use of the default() function is important for data normalization and preparation in log analysis, ensuring consistent and complete data sets for further processing and analysis. For example, in a security event log, ensuring that all events have a message can be crucial for quick triage.

Set Default Values for Fields - Example 3

Set default values for a field and replace empty values with relevant default value

Query
logscale
default(field=message, value="N/A", replaceEmpty=true)
Introduction

Setting default values of fields is necessary, if the fields are to be used in calculations with the eval() function. If not set to a value so the field is considered to be present, the event would be discarded during eval step.

In LogScale, empty values are by default kept as the field does indeed exist when it has the empty value.

This examples shows how to set replaceEmpty to true to replace empty values with the default as well.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    default(field=message, value="N/A", replaceEmpty=true)

    Replaces an empty value in the field message with the default value "N/A" by setting replaceEmpty to true.

  3. Event Result set.

Summary and Results

The query is used to replace empty values in a field to a defined default value. If not setting a default value for empty values, the event would be discharded during further eval steps because eval() requires all used fields to be present. The use of the default() function is important for data normalization and preparation in log analysis, ensuring consistent and complete data sets for further processing and analysis. For example, in a security event log, ensuring that all events have a message can be crucial for quick triage.