Calls the named function on a field over a set of events. The result is returned in a field named _function for the selected function. This allows having the function name as a dashboard parameter.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a] _function Name of output field.
fieldstringrequired   Field to extract a number from and calculate function over.
function[b]stringrequired   Function to run.
   Valid Values
   avgThe avg() function
   countThe count() function
   maxThe max() function
   minThe min() function
   rangeThe range() function
   sumThe sum() function

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name function can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Click + next to an example below to get the full details.

Call Named Function on a Field - Example 1

Calls the named function (avg()) on a field over a set of events

Query
logscale
avg_sent:=callFunction("avg", field=bytes_sent)
Introduction

In this example, the callFunction() function is used to find the average bytes sent in HTTP responses. It calls the named function (avg()) on a field over a set of events.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    avg_sent:=callFunction("avg", field=bytes_sent)

    Finds the average bytes sent in HTTP response, and returns the results in a new field named avg_sent. Notice that the avg() function is used indirectly in this example.

  3. Event Result set.

Summary and Results

The query is used to find the average bytes sent in HTTP responses. Using a query parameter (for example, ?function) to select the aggregation function for a timeChart() is useful for dashboard widgets.

Using callFunction() allow for using a function based on the data or dashboard parameter instead of writing the query directly.

Call Named Function on a Field - Example 2

Calls the named function (count()) on a field over a set of events

Query
logscale
timeChart(function=[callFunction(?{function=count}, field=value)])
Introduction

In this example, the callFunction() function is used to call the named function (count()) on a field over a set of events using the query parameter ?function.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    timeChart(function=[callFunction(?{function=count}, field=value)])

    Counts the events in the value field, and displays the results in a timechart.

    Notice how the query parameter ?function is used to select the aggregation function for a timeChart().

  3. Event Result set.

Summary and Results

The query is used to count events and chart them over time. Because we are using callFunction(), it could be a different function based on the dashboard parameter.

Using a query parameter (for example, ?function) to select the aggregation function for a timeChart() is useful for dashboard widgets.

Using callFunction() allow for using a function based on the data or dashboard parameter instead of writing the query directly.