toscalar()toscalar()

返回所计算的表达式的标量常数值。Returns a scalar constant value of the evaluated expression.

此函数对于需要暂存计算的查询很有用。This function is useful for queries that require staged calculations. 例如,计算事件总数,然后使用结果筛选超过所有事件的特定百分比的组。For example, calculate a total count of events, and then use the result to filter groups that exceed a certain percent of all events.

语法Syntax

toscalar(Expression)toscalar(Expression)

参数Arguments

  • 表达式:将针对标量转换进行计算的表达式。Expression: Expression that will be evaluated for scalar conversion.

返回Returns

所计算表达式的标量常数值。A scalar constant value of the evaluated expression. 如果结果是表格格式,则会采用第一列和第一行进行转换。If the result is a tabular, then the first column and first row will be taken for conversion.

提示

使用 toscalar() 时,可以使用 let 语句以提高查询的可读性。You can use a let statement for readability of the query when using toscalar().

备注Notes

可以在查询执行期间对 toscalar() 计算常数次数。toscalar() can be calculated a constant number of times during the query execution. toscalar() 函数不能应用于行级(for-each-row 方案)。The toscalar() function can't be applied on row-level (for-each-row scenario).

示例Examples

StartEndStep 作为标量常数计算,并将结果用于 range 计算。Evaluate Start, End, and Step as scalar constants, and use the result for range evaluation.

let Start = toscalar(print x=1);
let End = toscalar(range x from 1 to 9 step 1 | count);
let Step = toscalar(2);
range z from Start to End step Step | extend start=Start, end=End, step=Step
zz startstart endend 步骤step
11 11 99 22
33 11 99 22
55 11 99 22
77 11 99 22
99 11 99 22