Calls the named function on a field over a set of events. The result is returned in a field named _function for the selected function. This allows having the function name as a dashboard parameter.
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
as | string | optional[a] | _function | Name of output field. |
field | string | required | Field to extract a number from and calculate function over. | |
function [b] | string | required | Function to run. | |
Valid Values | ||||
avg | The avg() function | |||
count | The count() function | |||
max | The max() function | |||
min | The min() function | |||
range | The range() function | |||
sum | The sum() function | |||
[a] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
function
can be omitted; the following forms of this function are equivalent:logscale SyntaxcallFunction("value",field="value")
and:
logscale SyntaxcallFunction(function="value",field="value")
These examples show basic structure only.
callFunction()
Examples
Find the average bytes sent in http responses using callFunction() rather than using avg directly.
avg_sent:=callFunction("avg", field=bytes_sent)
Use a query parameter (for example,
?function
) to select the aggregation
function for a timeChart()
. This is useful for
dashboard widgets.
timechart(function=[callFunction(?{function=count}, field=value)])