Calls the named function on a field over a set of events. The result is returned in a field named _function for the selected function. This allows having the function name as a dashboard parameter.

ParameterTypeRequiredDefaultDescription
asstringfalse Name of output field. Defaults to _function.
fieldstringtrue Field to extract a number from and calculate function over.
functionstringtrue Function to run. [a]

[a] When you provide only one parameter, the implied parameter is function

Examples

Find the average bytes sent in http responses using callFunction() rather than using avg directly.

humio
avg_sent:=callFunction("avg", field=bytes_sent)

Use a query parameter (i.e., ?function) to select the aggregation function for a timechart (). This is useful for dashboard widgets.

humio
timechart(function=[callFunction(?{function=count}, field=value)])