Feedback:

foreach

Use the foreach operator to iterate through a selection of fields and apply a subsearch to each field.

Syntax

|foreach <field-list> [ <subsearch> ]

<field-list>

A comma-separated list of fields to iterate through. The wildcard * specifies to iterate the subsearch over all fields.
[ <subsearch> ]

A calc command to be executed as the fields are iterated through.

Subsearch can use a template value <<FIELD>> that is replaced by each field in the specified field list when the calc function is executed.

Usage

The foreach operator can be used to obtain results from across multiple fields in each row. This can be useful for calculating the sum or average of a selection of fields, for example.

Examples

Example 1: Iterate calculations across multiple tables.

Copy 
|foreach test1, test2, test3 [ calc total = total + <<FIELD>> ]

Example 2: Apply operations to each table separately.

Copy 
|foreach * [ calc <<FIELD>> = concat(<<FIELD>>, 'abc') ]

Example 3: Aggregates event counts by status, then counts those counts, then iterates over each of the cnt and cnt2 fields adding the current value of the field to cnt in each iteration.

Copy 
ocsf | aggr count as cnt by status |aggr count as cnt2 by cnt | foreach cnt, cnt2 [ CALC cnt = cnt + <<FIELD>> ]