Calls the named function on a field over a set of events. The result is returned in a field named _function for the selected function. This allows having the function name as a dashboard parameter.

ParameterTypeRequiredDefaultDescription
asstringoptional[a]_function Name of output field.
fieldstringrequired  Field to extract a number from and calculate function over.
function[b]stringrequired  Function to run.
  Valid Values
   avgThe avg() function
   countThe count() function
   maxThe max() function
   minThe min() function
   rangeThe range() function
   sumThe sum() function

[a] Optional parameters use their default value unless explicitly set

[b] The argument name function can be omitted.

Omitted Argument Names

The argument name for function can be omitted; the following forms of this function are equivalent:

logscale
callFunction("avg")

and:

logscale
callFunction(function="avg")

Find the average bytes sent in http responses using callFunction() rather than using avg directly.

logscale
avg_sent:=callFunction("avg", field=bytes_sent)

Use a query parameter (i.e., ?function) to select the aggregation function for a timeChart(). This is useful for dashboard widgets.

logscale
timechart(function=[callFunction(?{function=count}, field=value)])