The value of a synthetic field is based on the value of an existing field. Synthetic sources are dynamic and do not exist for every event generated for the specific data that it relates to. A synthetic field uses an expression on the source field to obtain its value.
A synth expression is executed on the value from the synth source field. The result of this evaluation becomes the value of the Synthetic field. There are different types of expressions that can be applied to a synth source.
numerical functions - can be used to do type and unit conversations on numerical fields. There are two numerical evaluators provided by logscape; jep and mvel. For example an mvel expression in the example below converts the field Gigabytes to the megabytes.
mvel:Gigabytes/1000
groovy script A groovy script has the following syntax
groovy-script: return 1
Here is a simple example of a groovy script which will take a time field in the format HH:MM:SS and convert it into seconds. In this example the Synth Source is the name of the column that has the time format in it.
groovy-script:
x = connectedTime.split(":")
total = (Integer.parseInt(x[0]) * 60 * 60)
total += (Integer.parseInt(x[1]) * 60)
total += (Integer.parseInt(x[2]))
return total
string functionsThe syntax for the string functions is as follows
FUNC,param1,param2 ...
