Take Field Names as Parameters
Query
logscale
| test(getField(?foo)==?bar)
Introduction
Use the function to take a field name as a parameter.
Given an event with the following fields:
|----------------------|
| hello | world |
|----------------------|
Test if a field exists on an event with a specific value where both the field and the value are given as parameters. This query:
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| test(getField(?foo)==?bar)
Tests if the field given by the parameter
?foo (hello)
is equal to the value given by the parameter?bar (world)
. Event Result set.
Summary and Results
hello |
---|
world |