*|eval <new_field_name>=<expression>

For examples of using this command in typical scenarios, see:

• Rename the Fields by Editing the Query
• Mark the Unit for a Field at Query Time
• Histogram Chart Options
• Visualize Time Series Data Using the Link Trend Feature
• Generate Charts with Virtual Fields
• Link by Using SQL Statement as the Field of Analysis
• Analyze the Time Taken Between Steps in a Transaction
• Use Link Navigation Functions to Identify Events in a Database
• Add URLs to Link Table
• Use URL Short-Cut with Custom Name
• Use the Currency Symbols in Your Log Analysis

Following are some examples of the eval command.

*|eval newField = 'foo'

*|eval newField = 123

*|eval newField = upper(Target)

*|eval newField = length('hello world')

*|eval newField = replace('aabbcc', 'bb', 'xx')

*|eval newField = concat(host, concat (':', port))

*| eval n = contains(uri, '.com')

*| eval n = lastindexOf(uri, '.com')

*| eval s = reverse(Command)

*|eval newField = host || ':'|| port

*|eval newField = substr('aabbcc', 2, 4)

*|eval newField = round(123.4)

*|eval newField = floor(4096/1024)+Length

*|eval newField = if (max(Length)(Target), length(Severity)) <= 20, 'OK', 'ERROR')

*|eval newField = urldecode('http%3A%2F%2Fexample.com%3A893%2Fsolr%2FCORE_0_0%2Fquery')

*|eval newField = 'Host Name (Destination)' in (host1, host2)

The following example compares the IP addresses in the field srvrhostip to a subnet range.

*|eval newField = if (cidrmatch(srvrhostip, '192.0.2.254/25') = 1, 'local', 'not local')

The following example returns the string “Target”.

*|eval newField = literal(Target)

The following example removes the spaces and tabs from both the ends.

*|eval newField = trim(Label)

The following example removes the matching character from both the ends.

*|eval newField = trim('User Name',h)

The following example removes the matching character from the left end.

*|eval newField = ltrim('Error ID',0)

The following example removes the matching character from the right end.

*|eval newField = rtrim('OS Process ID',2)

The following example sets the field date to Start Date and defines the format of the date as MM/dd/yyyy HH:mm.

*|eval date = toDate('Start Date', 'MM/dd/yyyy HH:mm')

The function toDate can also be used to handle epoch as follows:

... | where 'Start Time' > toDate(1405544998000)

The following example sets the value of the field duration to 1.30.

*|eval duration = toduration("1.30")

The following example sets the value of the field duration to a numerical value which is the difference of End Time and Start Time.

*|eval duration = formatDuration('End Time' - 'Start Time')

The following examples illustrate the use of date functions.

*| eval lastHour = dateAdd(now(), hour, -1)
*| eval midnight = dateSet(now(), hour, 0, minute, 0, sec, 0, msec, 0)
*| eval timeOnly = formatDate(now(), 'HH:mm:ss')
*| eval now = now()

The following example sets the value of the field newField with the position of .com in the uri string.

*|eval newField = indexOf(uri, '.com')

You can use the md5, sha1, sha256, and sha512 hash functions with the eval command to filter log data. The following example sets the value of the field user with the value sha1("jane").

*|eval user = sha1("jane")

* | eval newField = unit('Content Size', KB)

* | eval 'File Size (bytes)' = unit('File Size', 'byte')

* | eval 'File Size (KB)' = unit('File Size'/1024, 'kb')

* | eval 'File Size (MB)' = unit('File Size'/(1024*1024), 'mb')

* | eval 'Time Taken (Sec)' = unit(Time/1000, 'SEC')

* | eval Vol = unit('Content Size Out', byte) | stats sum(Vol) as 'Total Volume'

* | eval Sales = unit('Sales Amount', currency_usd) | stats sum('Sales') as 'Total Sales'

* | eval 'Disk Read Time' = unit('Disk Read Time (millis)', ms) | stats avg('Disk Read Time') as 'Avg Disk Read Time'

'Log Source' = 'FMW WebLogic Server Access Logs'
| link span = 5minute Time, Server
| stats avg('Duration')     as 'Raw Avg. Duration'
        avg('Content Size') as 'Raw Avg. Transfer Size'
| eval 'Average Duration'      = unit('Raw Avg. Duration', ms)
| eval 'Average Transfer Size' = unit('Raw Avg. Transfer Size', byte)
| classify 'Start Time', 'Average Duration', 
          'Average Transfer Size' as 'Response Time vs. Download Sizes'

| eval 'Amount in USD' = unit('Sales Price', currency_usd)
| eval 'Amount in Thousands (USD)' = usd('Quarterly Sales', currency_usd_thousand)
| eval 'Amount in Millions (USD)' = usd('Annual Profit', currency_usd_million)
| eval 'Amount in Billions (USD)' = usd('Annual Sales', currency_usd_billion)