Best Practice: Using the assignment operator

LogScale Query Language (LQL) is the syntax that allows you to create queries to retrieve, process, and analyze data. Part of LQL is the eval() function, which assigns fields to input while simultaneously doing numeric computations. A shorthand of eval() is :=, known as the assignment operator:

:=

In Event Search, we would typically use eval() in places where the assignment operator is used in LogScale. Here's an quick example:

| timeDelta := now() - (ProcessStartTime*1000)

This query says, "Assign the value of the field timeDelta to the current time, minus the value of ProcessStartTime, multiplied by 1000.

For a thorough introduction to LQL syntax, refer to Query Language Syntax.