Creates a new field by evaluating the provided expression. The eval string must always start with an assignment (f=expr). The result is stored in a field with that name. In an expression, it's possible to supply names of fields, strings and numbers. The operators available are ==, !=, as well as +, -, *, and / and parenthesized expressions.

eval() accepts multiple expressions to be evaluated, separated by a comma, in the form of field_name = expression.

The following are all valid examples:

eval(a = 3)

eval(a = b, x = y + z)

In the context of an eval() expression — unlike filters — identifiers always denote field values. For example:

eval( is_warning= (loglevel==WARN) )

is most likely wrong; you want to write:

(loglevel=="WARN")

The order of evaluation of arguments is left to right.

The expression:

eval(f=expr)

only results in an assignment to f when expr yields a result — which is not the case when a field in the expression does not exist, or it's not a number.

This means that fields are not created if the source event is missing a value.

If f already existed as a field on the event and expr did not yield any result, then f is unchanged.

eval(responsesize = responsesize / 1024)

eval(c = a + b)

timechart(method, span=5min)
| eval(_count=_count/5)