...

Executes an expression on the resulting search events.

Syntax

execute <expression>[expression] (as column1, column2)

Required Arguments

...

Description: If the results that the executed expression returns are expected to go into more than one column, the names of the columns preceded by as must be placed in parentheses following the expression. 

...

Executes an expression on each event in the search query. If the returned results go into more than one column, they are entered under the columns whose names appear in parentheses after the expression.

Examples

Example

...

1: 

* in log.access |  execute if (total == NULL) THEN (total = 0); if (column.bytes\ sent != NULL && column.bytes\ sent != "-") THEN (total = total + column.bytes\ sent);total | group by status | order by value desc 

...