| Table of Contents | ||||
|---|---|---|---|---|
|
Description
You can apply this operation either as a Filter or Create columnfield operation:
Filter | Retrieves those events where at least one of the given Boolean column field values is true. |
|---|---|
Create columnfield | Creates a Boolean columnfield that returns true only if and only if one of the given arguments are true. |
How does it work in the search window?
Select Filter / Create column field in the search window toolbar, then select the Or operation. This operation requires at least two Operand arguments, but you can add more as needed.
Argument | Data type |
|---|---|
Operand mandatory | boolean |
Operand mandatory | boolean |
If you use the Create columnfield operation, the data type of the values in the new column field is boolean (true or false).
Example
In the demo.ecommerce.data table, we want to display only those events where either the bytes transferred are greater than 1000 or the time taken to send them is greater than 200 (or both). To do it, we will apply a Filter using the Or operation but first, we need to create the required Boolean columnsfields.
Step 1: Create the dedicated
columnsfields with Boolean values
We need two new columnsfields. One for the first condition (bytesTransferred>1000), and one for the second condition (timeTaken>200). Here is how we define these columnsfields, using the Greater than (gt, >) operation.
Once created, we will have two Boolean columns fields containing a true or false value for each row.
_05.png?version=1&modificationDate=1661166018352&cacheVersion=1&api=v2)
.png?version=1&modificationDate=1683797528602&cacheVersion=1&api=v2)
_06.png?version=1&modificationDate=1661166070207&cacheVersion=1&api=v2)
.png?version=2&modificationDate=1683797541886&cacheVersion=1&api=v2)
Step 2: Apply the filter using the Or operation
Select Filter on the query toolbar, then select Or as the operator. Now select the columns fields that you created as arguments:
Operand - bytestransferred>1000 column field
Operand - timetaken>200 column field
_10v2.png?version=1&modificationDate=1661166187566&cacheVersion=1&api=v2)
.png?version=1&modificationDate=1683797554811&cacheVersion=1&api=v2)
Click Filter data. The table displays only those rows where either the timetaken>200 or the bytestransferred>1000 value (or both) is true.
_20.png?version=1&modificationDate=1653296592250&cacheVersion=1&api=v2&width=566)
.png?version=1&modificationDate=1683797562338&cacheVersion=1&api=v2)
Click Create columnfield and follow the same steps to add a new Boolean column field that shows true when either the timetaken>200 value or the bytestransferred>1000 value (or both) is true.
How does it work in LINQ?
Use the operator where... to apply the Filter operation and select... as... to apply the Create column field operation. This is the syntax for the Or operation:
boolean1 or boolean2 or ...
Examples
You can copy the following LINQ script and try the above example on the demo.ecommerce.data table:
| Code Block |
|---|
from demo.ecommerce.data
select bytesTransferred > 1000 as `bytesTransferred>1000`,
timeTaken > 200 as `timeTaken>200`
where `bytesTransferred>1000` or `timeTaken>200` |
And this is the same example using the Create columnfield operation:
| Code Block |
|---|
from demo.ecommerce.data
select timeTaken > 200 as `timeTaken>200`,
bytesTransferred > 1000 as `bytesTransferred>1000`,
`timeTaken>200` or `bytesTransferred>1000` as `time>200&bytes>1000` |