It would be great if "eval" could do multiple evaluations in a single command, in a similar way that "stats" can:
stats sum(someField) as "sumField" sum(otherField) as "sumOtherField"
and with eval:
... | eval field1=(eval statement) field2=(eval statement)
instead of | eval | eval | eval
Yes it would but this isn't a question. I suggest you contact support asking for this as an enhancement request.
Yes it would but this isn't a question. I suggest you contact support asking for this as an enhancement request.
ok, sorry, thought this forum could be used for suggestions / feedback around ideas.