Eval function adds or removes fields from events. (In Splunk these are index-time fields).
Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.
Evaluate Fields: Set of key-value pairs to add. Left-hand side input is the key name, right-hand side is a JS expression to compute the value (can be constant).
Keep Fields: List of fields to keep. Wildcards (*) supported. Takes precedence over Remove Fields (below).
Remove Fields: List of fields to remove. Wildcards (*) supported. Cribl internal fields that start with
__ (double underscore) cannot be remove via wildcard. Instead they need to be specified individually. For example,
__myField cannot be removed by specifying
__myF. A field matching an entry in Keep (wildcard or not) and Remove will not be removed. This is useful for implementing “remove all but” functionality. For example, to only keep
_time, _raw, source, sourcetype, host we can specify them all in Keep while specifying
* in Remove.
See Index-time Fields for examples.
The Eval function has the ability to execute expressions without assigning their value to the field of an event. This can be done by simply leaving the left-hand side input empty and having the right hand side do the assignment.
- Simple Example:
Object.assign(foo, JSON.parse(bar), JSON.parse(baz))on the right-hand side (and left-hand side empty) will json parse the strings in
baz, merge them and assign their value to
foo, an already existing field.
- Another Example: To parse JSON enter
Object.assign(__e, JSON.parse(_raw))on the right-hand side (and left-hand side empty).
__eis a special variable that refers to the (context) event within a JS Expression. In this case, content parsed from
_rawis added at the top level of the event.
The Eval function can also be used to set and unset control fields (e.g.,
_TCP_ROUTING in Splunk) via this syntax:
_ctrl.<name>. They can only be referenced on the left hand side of Add i.e. they cannot be read or used on the right hand side, and cannot be referenced in Remove. To unset/delete, set the value to
undefined. These fields are normally not needed for event computations and modifying them is suggested to be done only by experts. Please reach out to Cribl team if you need help with this topic.