Synopsis

Executes an expression on the resulting search events.

Syntax

execute <expression> (as column1, column2)

Required Arguments

expression

Syntax: mathematical expression

Description: Performs a mathematical expression on the search results.

Optional Arguments

column1, column2, ..., columnn

Syntax: <search string>.

Description: If the results that the executed expression returns are expected go into more than one column, the names of the columns preceded by as must be placed in parentheses following the expression. 

Description

Executes an expression on each event in the search query. If the returned results go into more than one column, they are entered under the columns whose names appear in parentheses after the expression.

Examples

Example 1: * in log.access |  execute if (total == NULL) THEN (total = 0); if (column.bytes\ sent != NULL && column.bytes\ sent != "-") THEN (total = total + column.bytes\ sent);total | group by status | order by value desc 

***.