The createEvents() function generates temporary events as part of the query. The function is ideal for generating sample data for testing or troubleshooting.

Example incoming data might look like this:

The query is used to create temporary events. The createEvents() function can be combined with different parsers to generate more interesting events, for example, with kvParse() or parseJson().

Sample output from the incoming example data:

In this example, the createEvents() function is combined with parseJson() to parse @rawstring as JSON.

Example incoming data might look like this:

The query is used to create temporary events and parse the @rawstring as JSON.

Sample output from the incoming example data:

In this example, the createEvents() function is combined with kvParse() to parse @rawstring as JSON.

Example incoming data might look like this:

The query is used to create temporary events and parse the @rawstring as key value pairs.

Sample output from the incoming example data:

In this example, the bit field is named flags and has the value 4 corresponding to the bit string 00000100. The goal is to extract two flags based on their bit value.

The query is used to extract and match values to bit flags. Creating events based on bit flags are useful when testing and troubleshooting on values, as it is faster to compare values stored as bitmasks compared to a series of booleans. Furthermore, events based on bit flags uses considerably less memory.

Sample output from the incoming example data:

In this example, the createEvents() function is used to do a free-text search for fooin a rawstring. The * around the value is to ensure, that we are looking for any value in @rawstring where foo is in the middle with any prefix or suffix.

The query is used specifically to perform a free-text search in the @rawstring field. This can be useful in any case you may want to search a specific field name to check for that first part.