The eval command is perhaps the most advanced and powerful command in SPL. It allows you to store the resulting value of the eval operation in a field. A myriad of functions can be used with eval. Let us try some of the simpler and more common ones.
The simplest type of eval command performs a simple if/then/else condition and stores a value in the newly created field. For example, if you want to create counts of successful and unsuccessful requests, use http_status_code to determine whether the request is successful, and, if it is, count the transaction as successful:
SPL> index=main earliest=-1h latest=now | stats count(eval(if(http_status_code < "400", 1, NULL))) AS successful_requests count(eval(if(http_status_code >= "400", 1, NULL))) AS unsuccessful_requests by http_status_code
There are also countless functions that...
