Addition, sum, plus / Concatenation (add, +)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

Adds a new field that returns the addition or concatenation of the given elements. Depending on the input data types, this operation can be used in different ways:

Addition of two or more numbers (float or integer). This operation returns a float or integer.
Addition of two or more duration fields. This operation returns a duration.
Addition of a timestamp and a duration. This operation returns a timestamp.
Concatenation of two or more strings. This operation returns a string.

How does it work in the search window?

Select Create field in the search window toolbar, then select the Addition, sum, plus / Concatenation operation. You need to specify at least two arguments:

Argument	Data type

Argument

Data type

Add / Concat ^mandatory

float, integer, timestamp, duration, string

If you introduce a string data type in both arguments (Add and plus), the Add argument will be renamed as Concat.

plus ^mandatory

float, integer, timestamp, duration, string

You can add as many plus arguments as required, unless you use a timestamp data type, which allows only one.

Valid combinations

The arguments are interdependent, in other words, the data type introduced in one of them determines the data types that are valid for the others (see Description section above for the list of combinations).

If you introduce an invalid combination of data types as arguments, an error icon will appear next to the argument in question and you will be informed about some of the valid options via tooltip.

The data type of the new field values can be float, integer, duration, timestamp, or string, depending on the arguments selected. See Description section above for the list of combinations and output data types.

Example

In the demo.ecommerce.data table, we want to add 300 to all the values in the bytesTransferred field. To do it, create a new field using the Addition, sum, plus / Concatenation operation. Let's call the new field bytesTransferred+300

The arguments needed to create the new field are:

Add - bytesTransferred field
plus - Click the pencil icon and enter 300

Click Create field and you will see the following result:

How does it work in LINQ?

Use the operator select... as... and add the operation syntax to create the new field. These are the valid formats of the Addition, sum, plus / Concatenation operation:

number1 + number2 +...
duration1 + duration2 +...
timestamp + duration
string1 + string2 +...
add(number1, number2,...)
add(duration1, duration2,...)
add(timestamp, duration)
add(string1, string2,...)

Using this operation in Activeboards

Be aware that using this operation in Activeboards presents an important limitation: the number of arguments is limited to two.

As a workaround, you can perform subsequent adding operations until you have added all the arguments you need. Visit this article for more syntax differences between the Search Window and Activeboards.

Workaround example → select add(number1, number2) as A, add(A, number3) as B, add(B, number4) as C...

Example

You can copy the following LINQ scripts to try example in different tables:

from siem.logtrust.web.activity
  select responseTime + 1000 as `responseTime+1s`

or

from demo.ecommerce.data
  select add(bytesTransferred, 300) as `bytesTransferred+300`