To classify recent earthquakes based on their depth, you use the following search.įROM all_month | eval Description=case(depth70 AND depth300, "Deep") | stats count() min(Mag) max(Mag) by Description In subduction zones, deep-focus earthquakes may occur at much greater depths (ranging from 300 up to 700 kilometers). The data is a comma separated ASCII text file that contains magnitude (mag), coordinates (latitude, longitude), region (place), and so forth, for each earthquake recorded.Įarthquakes occurring at a depth of less than 70 km are classified as shallow-focus earthquakes, while those with a focal-depth between 70 and 300 km are commonly termed mid-focus earthquakes. | eval error = if(status = 200, "OK", "Problem") Separate events into categories and calculate the count, minimum, maximum for each category This example uses recent earthquake data downloaded from the USGS Earthquakes website. Otherwise set the error field value to Problem. Suppose that you want to create a field called error and set the value in the error field to OK if the status value is 200. The functions are organized into these categories: There are dozens of built-in functions that you can use in the eval expression. | eval velocity=distance/time Using eval functions This example creates a new field called velocity in each event and calculate the velocity by dividing the values in the distance field by the values in the time field. Suppose you want to divide the values in one field by the values in another field. One type of expression you can perform is a mathematical expression, such as multiplication, division, addition, and subtraction. There are many types of expressions you can specify. Most of the time the eval command is used to create a new field in your search results and the values in that new field are the result of an expression. The search processes multiple eval expressions left-to-right and lets you reference previously evaluated fields in subsequent expressions.Įval =. You can chain multiple eval expressions in one search using a comma to separate subsequent expressions. The eval command evaluates mathematical, string, and boolean expressions.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |