eval

Evaluates expressions to add fields to each record or change the values of existing fields.

Command properties

Syntax

FIELD

Name of the field to assign a value to

EXPR

Expression to assign to the field. You can reference constants, functions, and other fields.

• You can assign multiple fields at once by separating them with commas (,).
• Within the same eval command, a previously assigned field can be referenced in a subsequent expression.

Error codes

Parse errors

Runtime errors

N/A

Description

The eval command evaluates an expression for each input record and assigns the result to the specified field. If the field already exists, its value is overwritten. If it does not exist, a new field is added.

Examples

1. Calculate field values

   json "{}" | eval sent = 100, rcvd = 200, total = sent + rcvd
   

   Assigns sent and rcvd fields, then assigns the sum of the two values to the total field.

2. Type conversion using a function

   json "{}" | eval num = int("100")
   

   Converts the string "100" to an integer and assigns it to the num field.

3. String concatenation

   json "{}" | eval msg = concat("hello", ", world")
   

   Concatenates strings using the concat function and assigns the result to the msg field.

4. Add a field using a conditional expression

   table duration=1h WEB_LOGS | eval result = if(status == 200, "success", "fail")
   

   Assigns success or fail to the result field based on the value of the status field.