Synopsis

Executes an expression on the resulting search eventsa custom complex computation on search query results.

Syntax

execute [expression] (as column1result1, column2result2)

Required Arguments

expression

...

Description: Performs a mathematical expression on the search results.

Optional Arguments

column1result1, column2, ..., columnnresult2

Syntax: <search string>.

Description: If the results that the executed expression returns are expected to go into more than one column, the names of the columns preceded by as must be placed in parentheses following the expression. 

...

* in log.access |  execute if (total == NULL) THEN (total = 0); if (column.bytes\ sent != NULL && column.bytes\ sent != "-") THEN (total = total + column.bytes\ sent);total | group by status | order by value desc 

***.