Calls the named function on a field over a set of events. The result is returned in a field named _function for the selected function. This allows having the function name as a dashboard parameter.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]_function Name of output field.
fieldstringrequired  Field to extract a number from and calculate function over.
function[b]stringrequired  Function to run.
   Valid Values
   avgThe avg() function
   countThe count() function
   maxThe max() function
   minThe min() function
   rangeThe range() function
   sumThe sum() function

[a] Optional parameters use their default value unless explicitly set.

[b] The argument name function can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Find the average bytes sent in http responses using callFunction() rather than using avg directly.

logscale
avg_sent:=callFunction("avg", field=bytes_sent)

Use a query parameter (i.e., ?function) to select the aggregation function for a timeChart(). This is useful for dashboard widgets.

logscale
timechart(function=[callFunction(?{function=count}, field=value)])