Evaluation Process Plugin installs the eval process command which evaluates mathematical, boolean and string expressions during a Logpoint search and adds the evaluation result in an identifier as a new field.
Important
Identifier name is not the same as an existing field name. If it is, Logpoint discards the value of the identifier.
When using a string value in an eval expression, always place the string within single quotes (‘’).
Eval expressions use the normalized field values from a log event to calculate the evaluation result.
Invalid expression generates error and halts search query.
eval displaying Error Message¶
Syntax:
| process eval("identifier=expression")
Identifier: Contains result of evaluating expressions.
Expression: A combination of numbers, variables, operators, functions, brackets and punctuation marks grouped to represent a value.
The expressions are evaluated based on the following operator’s order:
Arithmetic: Multiplication (*) and Division (/) executed first.
Arithmetic: Addition (+) and Subtraction (-) evaluated after multiplication and division.
Note
The higher priority of Power (^) over multiplication and division is not currently considered.
Example:
| process eval("Revenue=unit_sold*Selling_price")
Using eval Expression¶
Here, the query calculates the value of Revenue by multiplying the values of unit_sold and Selling_price.