| Table of Contents | ||||
|---|---|---|---|---|
|
...
Argument | Data type | ||
|---|---|---|---|
Add / Concat mandatory | float, integer, timestamp, duration, string If you introduce a string data type in both arguments (Add and plus), the Add argument will be renamed as Concat. | ||
plus mandatory | float, integer, timestamp, duration, string You can add as many plus arguments as required, unless you use a timestamp data type, which allows only one. | ||
| |||
The data type of the new field values can be float, integer, duration, timestamp, or string, depending on the arguments selected. See Description section above for the list of combinations and output data types.
Example
In the demosiem.logtrust.ecommerceweb.dataactivity table, we want to add 3001000 to all the values in the bytesTransferred fieldresponseTime field to add one second to the time. To do it, create a new field using the Addition, sum, plus / Concatenation operation. Let's call the new field bytesTransferredresponseTime+3001s.
The arguments needed to create the new field are:
...
Use the operator select... as... and add the operation syntax to create the new field. These are the valid formats of the Addition, sum, plus / Concatenation operation:
number1 + number2 +...duration1 + duration2 +...timestamp + durationstring1 + string2 +...add(number1, number2,...)add(duration1, duration2,...)add(timestamp, duration)add(string1, string2,...)
| Info |
|---|
Using this operation in Activeboards Be aware that using this operation in Activeboards presents an important limitation: the number of arguments is limited to two. As a workaround, you can perform subsequent adding operations until you have added all the arguments you need. Visit this article for more syntax differences between the Search Window and Activeboards. Workaround example → |
Example
You can copy the following LINQ scripts to try example in different tables:
| Code Block |
|---|
from siem.logtrust.web.activity select responseTime + 1000 as `responseTime+1s` |
...