Evaluates an arbitrary expression as a boolean value and filters events when the expression returns true. Not only can Falcon LogScale make comparisons between one field and one value, but it can also compare more fields and their respective values, using the test() function.

Note

In test() unquoted strings are interpreted as field names.

ParameterTypeRequiredDefault ValueDescription
expression[a]expressionrequired   The expression to test.

[a] The parameter name expression can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Hide negatable operation for this function

Show negatable operation for this function

test() Examples

The following tests if the value of the field foo is less than the value of the field bar:

logscale
test(foo < bar)

This example compares a field value within the LogScale repository:

logscale
test(cputime < 7500)

Click + next to an example below to get the full details.

Check if Field Contains Specific Value

Check if field contains specific value using test() function

Check if Fields Contain Same Value

Search for more fields with same length

Compare More Fields and Filter for Specific Events

Compare more fields and filter for events that are not twice as large using a negation statement

Compare More Fields and Their Respective Values

Compare more fields and their respective values

Evaluate Arbitrary Expression as Boolean Value

Evaluate an arbitrary expression as a boolean value and filter events when expression returns true

Evaluate Arbitrary Field Values for CPU Time Within Repository

Evaluate and compare field values for CPU time within a repository

Evaluate Field Values Within Repository

Compare field values within the Falcon LogScale repository

Search Relative Time to Query Execution

Writing a query that is executed against a time range relative to when the query is executed