annabad.blogg.se - Allmänt

If you do not specify the annotate argument, the results have only the _time field. Optional arguments count Syntax: count= Description: The number of results to generate. If you do not specify any of the optional arguments, this command runs on the local machine and generates one result with only the _time field. Generates the specified number of search results in temporary memory. This function takes a URL string and returns the unescaped or decoded URL string. The following example returns the values in the username field in uppercase. This function returns a string in uppercase.

| eval n=trim(" ZZZZabcZZ ", " Z") upper() The following example trims the leading spaces and all of the occurrences of the letter Z from the left and right sides of the string. If not specified, spaces and tabs are removed from both sides of the string.

This function removes the trim characters from both sides of the string. The following example concatenates the first 3 letters in the word splendid with the last 3 letters in the word chunk: The is optional, and if not specified returns the rest of the string. Negative indexes can be used to indicate a start from the end of the string. The indexes follow SQLite semantics they start at 1. The length of the substring specifies the number of character to return. This function returns a substring of a string, beginning at the start index. Index=twitter | eval output=spath(_raw, "entities.hashtags") substr(,) The following example returns the hashtags from a twitter event. The following example returns the values of locDesc elements from the _raw field. Using a field name for might result in a multivalue field.

If is a field name, with values that are the location paths, the field name doesn't need quotation marks.

If is a literal string, you need to enclose the string in double quotation marks.

The is an spath expression for the location path to the value that you want to extract from. Use this function to extract information from the structured data formats XML and JSON. | eval n=rtrim(" ZZZZabcZZ ", " Z") spath(,) The following example trims the leading spaces and all of the occurrences of the letter Z from the right side of the string. If not specified, spaces and tabs are removed from the right side of the string. This function removes the trim characters from the right side of the string. The argument can also reference groups that are matched in the ,) This function substitutes the replacement string for every occurrence of the regular expression in the string.

| eval x=ltrim(" ZZZZabcZZ ", " Z") replace(,) The following example trims the leading spaces and all of the occurrences of the letter Z from the left side of the string. If not specified, spaces and tabs are removed from the left side of the string. This function removes characters from the left side of a string. The following example returns the values in the username field in lowercase. This function returns a string in lowercase. This example returns the character length of the values in the categoryId field for each result. You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. The argument can be the name of a string field or a string literal. This function returns the character length of a string. The following list contains the functions that you can use with string values.įor information about using string and numeric fields in functions, and nesting functions, see Overview of SPL2 eval functions.