proc

Executes a user-defined procedure. When you pass arguments matching the parameter types defined in the procedure, the arguments are set as query parameters and the predefined query runs.

Command properties

Syntax

Target

PROC_NAME(ARGS, ...)

Procedure name and argument list. Pass expressions that can be evaluated as constants as arguments, matching the parameter types defined in the procedure. The parameter types supported by procedures are as follows:

• string: String
• int: 32-bit integer
• double: 64-bit floating-point
• bool: Boolean
• date: Date. Pass a string in "yyyy-MM-dd" format or a date value; the time is truncated to 00:00:00.
• datetime: Date and time. Pass a string in "yyyy-MM-dd HH:mm:ss" format or a date value.
• ip: IP address

Error codes

Parse errors

Runtime errors

N/A

Description

The proc command executes a previously registered procedure. A procedure consists of a query string and parameter definitions. When a procedure is called, the passed arguments are set as query parameters and the query defined in the procedure runs.

Only the procedure owner or a user granted execution permission can call the procedure. The internal query of the procedure runs with the procedure owner's permissions. This allows fine-grained control over access to specific queries.

You can reference parameter values in the procedure's internal query string using the $() function.

Examples

1. Calling a procedure

   Register the following query as a procedure named cpu_overload in the web console.

   table duration=1d sys_cpu_logs | search kernel + user >= $("threshold")
   

   Then call the procedure as follows:

   proc cpu_overload(90)
   

   The value 90 is passed to the threshold parameter, querying records where CPU usage is 90% or more.

2. Calling a procedure with multiple parameters

   Register the following query as a procedure named search_logs. This procedure takes src (string type) and min_bytes (int type) as parameters.

   table duration=1d web_logs | search src_ip == $("src") and bytes >= $("min_bytes")
   

   Call it as follows:

   proc search_logs("192.0.2.1", 1024)
   

   Queries records where src_ip is 192.0.2.1 and bytes is 1,024 or more.