Can anyone help me understand this eval search query?

[hastym]

I have recently started a new role and have been tasked with figuring out some old reports. The creator of the reports no longer works here so isn't available for a knowledge transfer. There is one piece of syntax which is repeated a couple of times that I can not figure out what it does.

Eval fieldX - {fieldY} = fieldX

I have read through the documentation but can't find anything specific to this syntax. If someone can point me towards relevant documentation or can explain this to me that would be appreciated.

[acharlieh · Accepted solution]

As written that eval would not work, as you need a single assignment on the left hand side (EDIT: Actually I'm wrong on that first sentence that syntax could work... it's making a prefixed field using the values of the bracketed field(s) ) ... but if you saw @alacercogitatus at a number of previous confs give his "Lesser Known Search Commands" talk, he actually covers this syntax... basically it takes the value of the field, and inserts that into the calculation...

For the most simplistic example I can think of here...

| makeresults count=2 | streamstats count | eval {count}="foo"

This search creates two results... the first result has fields count=1 and 1="foo" whereas the second has count=2 and 2="foo"

This is actually very useful when you need to do transforms on multiple dimensions of key value pairs where xyseries can't help... for example:

| makeresults count=8 | streamstats count | eval type=if(count%2==0,"X","Y"),app=if(count%4<2,"A","B"), class=if(count<=4,"F","G") | rename count -> value 

If the above produces your data set, where you have values of types X and Y for multiple apps and multiple classes... and you want to rll up those values by app and class pairs....

... | eval {type}=value | fields - type, value | stats values(*) as * by app,class

[hastym]

Thanks for the quick response @acharlieh. I have a grasp on the 'eval {count} = "foo"' kind of syntax.
I'm just confused as to what the syntax example I provided is doing.

Example:
fieldX is '12345'
fieldY is 'A'

what would be the result of the line:
Eval fieldX - {fieldY} = fieldX

[acharlieh]

You should try it out yourself! The beautiful thing about makeresults and eval is that you can use them to make synthetic results to try things out on:

| makeresults | eval fieldX="12345",fieldY="A" | eval fieldX-{fieldY} = fieldX

[hastym]

Great I never knew about that feature! Thanks for all the help @acharlieh