Create Two Temporary Events for Troubleshooting - Example 3

Create two temporary events for testing or troubleshooting using the createEvents() function with kvParse()

Query

logscale
createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])
| kvParse()

Introduction

The createEvents() function generates temporary events as part of the query. The function is ideal for generating sample data for testing or troubleshooting.

In this example, the createEvents() function is combined with kvParse() to parse @rawstring as JSON.

Example incoming data might look like this:

animal=dog weight=7.0
animal=cat weight=4.2

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])

    Creates two temporary events. An event with dog and an event with cat.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | kvParse()

    Parses the string into key value pairs.

  4. Event Result set.

Summary and Results

The query is used to create temporary events and parse the @rawstring as key value pairs.

Sample output from the incoming example data:

animalweight
dog7.0
cat4.2