Evaluation Process Plugin enables you to use the eval process command. The process command evaluates mathematical, boolean and string expressions during a LogPoint search and places the result of the evaluation in an identifier as a new field.
Syntax:
| process eval("identifier=expression")
Expression: An expression is a combination of numbers, variables, operators, functions, brackets and punctuation marks that are grouped to represent a value.
Identifier: An identifier contains the result of the evaluation of expressions.
Note
Make sure the name of the identifier is not the same as an existing field name. If the same name is used Logpoint discards the value of the identifier.
While using a string value in an eval expression, always place the string within single quotes (‘’).
An eval expression also uses an existing key from an event.
An invalid expression or syntax mismatch does not generate any exception or error.
Example:
| process eval("Revenue=unit_sold*Selling_price")
The above example calculates the value of Revenue by multiplying the values of unit_sold and Selling_price.
Eval Expression¶