Skip to main content

eval Metrics Operator

The eval operator evaluates a time series based on a user-specified arithmetic or mathematical function.


eval expr([REDUCER BOOLEAN EXPRESSION | _value] [_granularity])
  • expr is basic arithmetic or mathematical function: +, -, *, /, sin, cos, abs, log, round, ceil, floor, tan, exp, sqrt, min, max
  • _value is the placeholder for each data point in the time series.
  • REDUCER BOOLEAN EXPRESSION is an expression that takes all the values of a given time series, uses a function to reduce them to a single value, and evaluates that value. The supported functions are:
    • avg. Returns the average of the time series.
    • min. Returns the minimum value in the time series.
    • max. Returns the maximum value in the time series.
    • sum. Returns the sum of the values in the time series.
    • count. Returns the count of data points in the time series.
    • pct(n). Returns the nth percentile of the values in the time series.
    • latest. Returns the last data point in the time series.
    • stddev. Returns standard deviation of the points in the time series.
  • _granularity. Returns the length of the quantization bucket in milliseconds. You can use this placeholder in your query.


Example 1

This query returns the value of the CPU_Idle metric, multiplied by 100.

metric=CPU_Idle | eval _value * 100

Example 2

This query sets the value of each point in a single time series to the average of all values in that time series.

metric=CPU_Idle | eval avg

For example, if you have this series, where the points are (timestamp, value):

m1: (0, 1) (1, 2) (2, 3)
m2: (0, 3) (1, 6) (2, 9)

then eval avg would produce:

m1: (0, 2) (1, 2) (2, 2)
m2: (0, 6) (1, 6) (2, 6)

Example 3

This query returns the rate of change per second for the metric.

metric=CPU_Idle | sum | eval 1000 * _value / _granularity
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.