Addition, sum, plus / Concatenation (add, +)
- Juan Tomás Alonso Nieto (Deactivated)
- Borja Moro Moreno
- Former user (Deleted)
Description
Adds a new field that returns the addition or concatenation of the given elements. Depending on the input data types, this operation can be used in different ways:Â
Addition of two or more numbers (float or integer). This operation returns a float or integer.
Addition of two or more duration fields. This operation returns a duration.
Addition of a timestamp and a duration. This operation returns a timestamp.
Concatenation of two or more strings. This operation returns a string.
Concatenation of two or more tuples. This operation returns a tuple.
How does it work in the search window?
Select Create field in the search window toolbar, then select the Addition, sum, plus / Concatenation operation. You need to specify at least two arguments:
Argument | Data type |
|---|---|
Add / Concat mandatory | float, integer, timestamp, duration, string, tuple If you introduce a string data type in both arguments (Add and plus), the Add argument will be renamed as Concat. |
plus mandatory | float, integer, timestamp, duration, string, tuple You can add as many plus arguments as required, unless you use a timestamp data type, which allows only one. |
Valid combinations The arguments are interdependent, in other words, the data type introduced in one of them determines the data types that are valid for the others (see Description section above for the list of combinations). If you introduce an invalid combination of data types as arguments, an error icon will appear next to the argument in question and you will be informed about some of the valid options via tooltip. | |
The data type of the new field values can be float, integer, duration, timestamp, or string, depending on the arguments selected. See Description section above for the list of combinations and output data types.
Example
In the siem.logtrust.web.activity table, we want to add 1000 to all the values in the responseTime field to add one second to the time. To do it, create a new field using the Addition, sum, plus / Concatenation operation. Let's call the new field responseTime+1s.
The arguments needed to create the new field are:
Add - bytesTransferred field
plus - Click the pencil icon and enter 300
Click Create field and you will see the following result:
How does it work in LINQ?
Use the operator select... as... and add the operation syntax to create the new field. These are the valid formats of the Addition, sum, plus / Concatenation operation:
number1 + number2 +...duration1 + duration2 +...timestamp + durationstring1 + string2 +...tuple1 + tuple2 +...add(number1, number2,...)add(duration1, duration2,...)add(timestamp, duration)add(string1, string2,...)add(tuple1, tuple2,...)
Using this operation in Activeboards
Be aware that using this operation in Activeboards presents an important limitation: the number of arguments is limited to two.
As a workaround, you can perform subsequent adding operations until you have added all the arguments you need. Visit this article for more syntax differences between the Search Window and Activeboards.
Workaround example → select add(number1, number2) as A, add(A, number3) as B, add(B, number4) as C...
Example
You can copy the following LINQ scripts to try example in different tables:
from siem.logtrust.web.activity
select responseTime + 1000 as `responseTime+1s`or
from demo.ecommerce.data
select add(bytesTransferred, 300) as `bytesTransferred+300`