Take Field Names as Parameters

Retrieve values using parameters

Query

logscale
| test(getField(?foo)==?bar)

Introduction

Use the function to take a field name as a parameter.

Given an event with the following fields: 

|----------------------|
| hello      | world   |
|----------------------|

Test if a field exists on an event with a specific value where both the field and the value are given as parameters. This query:

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    | test(getField(?foo)==?bar)

    Tests if the field given by the parameter ?foo (hello) is equal to the value given by the parameter ?bar (world).

  3. Event Result set.

Summary and Results

hello
world