Take Field Names as Parameters

Query

logscale
| test(getField(?foo)==?bar)

Introduction

Use the function to take a field name as a parameter.

Given an event with the following fields:

|----------------------|
| hello      | world   |
|----------------------|

Test if a field exists on an event with a specific value where both the field and the value are given as parameters. This query:

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | test(getField(?foo)==?bar)

    Tests if the field given by the parameter ?foo (hello) is equal to the value given by the parameter ?bar (world).

  3. Event Result set.

Summary and Results

hello
world