callFunction( ) Query Function

Calls the named function on a field over a set of events. Result is returned in field named _function for the selected function. This allows having the function name as a dashboard parameter.


Name Type Required Default Description
function string Yes Function to run.
field string Yes Field to extract a number from and calculate function over.
as string No Name of output field. Defaults to _function

function is the unnamed parameter.


Find the average bytes sent in http responses using callFunction( ) rather than using avg directly.

avg_sent:=callFunction("avg", field=bytes_sent)

Use a query parameter (i.e., ?function) to select the aggregation function for a timechart( ). This is useful for dashboard widgets.

timechart(function=[callFunction(?{function=count}, field=value)])