Create Two Temporary Events for Troubleshooting - Example 3
Create two temporary events for testing or troubleshooting using the createEvents()
function with kvParse()
Query
createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])
| kvParse()
Introduction
The createEvents()
function generates
temporary events as part of the query. The function is ideal for
generating sample data for testing or troubleshooting.
In this example, the createEvents()
function is combined with kvParse()
to
parse @rawstring as JSON.
Example incoming data might look like this:
animal=dog weight=7.0 |
---|
animal=cat weight=4.2 |
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])
Creates two temporary events. An event with
dog
and an event withcat
. - flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| kvParse()
Parses the string into key value pairs.
Event Result set.
Summary and Results
The query is used to create temporary events and parse the @rawstring as key value pairs.
Sample output from the incoming example data:
animal | weight |
---|---|
dog | 7.0 |
cat | 4.2 |