Calls the named function on a field over a set of events. The result is
returned in a field named _function
for the selected function. This allows having the function name as a
dashboard parameter.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
as | string | false | Name of output field. Defaults to _function. | |
field | string | true | Field to extract a number from and calculate function over. | |
function | string | true | Function to run. [a] | |
Examples
Find the average bytes sent in http responses using callFunction() rather than using avg directly.
logscale
avg_sent:=callFunction("avg", field=bytes_sent)
Use a query parameter (i.e.,
?function) to select the
aggregation function for a timeChart(). This is
useful for dashboard widgets.
logscale
timechart(function=[callFunction(?{function=count}, field=value)])