eval

The eval operator displays events after evaluating the results of a specified function. This can be a mathematical, string, or boolean operation and is evaluated when the query is run. The resulting value is assigned to a field name. Once a new field has been defined by the eval operator, it can be used in the query to further refine the search results.

 

 

For information about other operators, functions, and syntax requirements, see Use an Operator in the Query.