Module 5 Filtering and formatting data Flashcards
what does the eval command allow you to do?
It allows you to calculate and manipulate field values in your report
eval fieldname1= expression1 [, eval fieldname2 = expression2…]
- calculate expressions
-place the results in a field
-use that field in searches or other expressions
where are the results of eval command written?
in either a new or existing field that yo have specified
what happens if the destination field of the eval command already exists?
the results of the eval replace the existing field..
The index values of the field are not modified
are field values of eval command treated in a case-sensitive manner?
yes
what type of functions does the eval command use?
Arithmetic +-*/%
Concatenation + .
Boolean AND OR NOT XOR
Comparison < > <= >= != = == LIKE
what does the round function perform with the eval command
it rounds the number to the decimal points you specify
what happens when you don’t specify the decimal points to round to when using the round function with the eval command?
It rounds to a whole number
how do you add or remove fields
fields - or fields + function
what does the tostring function do?
it converts a numeric filed to a value string
tostring(field, “option”)
what are the tostring Options?
- “commas” if the number includes decimals it rounds to 2 decimal places
- “duration” formats the numbers as “hh:mm:ss”
- “hex” formats the number in hexadecimal
True or False
eval with added characters converts numeric field values to string?
True
when wanting to sort numerically using eval what do you do first?
A. eval then sort
B. sort then eval
B
Can multiple expressions be combined into one eval command?
Yes,
each subsequent expression references the results of the previous expression
Expressions must be separated by commas
how many arguments does the if function take with the eval command?
3
if(X,Y,Z)
if X evaluates to TRUE, the result evaluates the second argument, Y
if X evaluates to FALSE, the result evaluates the third argument, Z
non-numeric values must be enclosed in “double quotes”
using the eval command are filed values treated in case-sensitive or non case-sensitive manner?
case sensitive
case function with the eval command….
case (X1,Y1,X2,Y2….)
what happens if the x1 argument which is a boolean expression evaluates as FALSE?
the next Boolean expression which is X2 is then evaluated etc etc
what functions do the search and where commands perform?
They both filter results
the like operator as part of the eval command what character is used for multiple characters?
%
use () for a single character
| stats count by src_ip like “10.%”
| where
what does fillnull command do
replace null values in fields
fillnull value=NULL
if no value=clause then the replacement value is 0
