This example returns the concatenated string values of "foo" and "bar". This example returns the base-8 number for 255. This example returns the value of pi to 2 decimal points (using the %f specifier) and the number 123 in exponential format with 2 decimal points (using %e specifier). This specifier uses either %e or %f depending on the range of the numbers being formatted. This example returns the value of pi to 2 decimal points.įloating point number. This example returns the number 5139 in exponential format with 2 decimal points. Printf("%d,%i,%d",-2,+4,30) which returns -2,4,30įloating point number, exponential format This example returns the positive or negative integer values, including any signs specified with those values. This example returns the unicode code point for 65 and the first letter of the string "Foo". This example returns the value of pi to 3 decimal points, in hexadecimal format. The following table describes the supported conversion specifiers.įloating point number in hexadecimal format The value can be a string, number, or field name. Syntax: "(%)." arguments Description: The arguments are optional and can include the width, precision, and the value to format. The format must be enclosed in quotation marks. Each conversion specifier can include optional components such as flag characters, width specifications, and precision specifications. You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.įormat Description: The format is a character string that can include one or more format conversion specifiers. The SPL printf function is similar to the C sprintf() function and similar functions in other languages such as Python, Perl, and Ruby. The values can be strings, numbers, computations, or fields. This function builds a string value, based on a string format and the values specified. In this example, the masked value is 0.20.0.96. The following example shows how to use the ipmask function in the WHERE clause of the from command to filter the events on a specific mask value: This search masks every IP address in the clientip field and returns the results in an aliased field called maskedip. | eval maskedIP = ipmask("0.255.0.244", clientip) AS maskedip The following example shows how to use the ipmask function in the SELECT clause of the from command: The output of this example is 10.20.30.0. The following example shows how to use the ipmask function with the eval command: You can use this function with the eval command, and as part of eval expressions. The must be a valid IPv4 address or a field name where the field value is a valid IPv4 address.Ī valid IPv4 address is a quad-dotted notation of four decimal integers, each ranging from 0 to 255.įor the argument, you can specify one of the default subnet masks such as 255.255.255.0. You can use this function to simplify the isolation of an IPv4 address octet without splitting the IP address. This function generates a new masked IP address by applying a mask to an IP address through a bitwise AND operation. The following list contains the functions that you can use to mask IP addresses and convert numbers to strings and strings to numbers.įor information about using string and numeric fields in functions, and nesting functions, see Evaluation functions.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |