Result Modification (SRM) – Outline

Detailed Course Outline

Topic 1 - Manipulating Output

  • Convert a 2-D table into a flat table with the untable command
  • Convert a flat table into a 2-D table with the xyseries command

Topic 2 - Modifying Result Sets

  • Append data to search results with the appendpipe command
  • Calculate event statistics with the eventstats command
  • Calculate "streaming" statistics with the streamstats command
  • Modify values to segregate events with the bin command

Topic 3 - Managing Missing Data

  • Find missing and null values with the fillnull command

Topic 4 - Modifying Field Values

  • Understand the eval command
  • Use conversion and text eval functions to modify field values
  • Reformat fields with the foreach command

Topic 5 - Normalizing with eval

  • Normalize data with eval functions
  • Identify eval functions to use for data and field normalization