Adds a set of fields describing the storage locations of this event.

ParameterTypeRequiredDefault ValueDescription
prefixstringoptional[a] @ Prefix of output fields.

[a] Optional parameters use their default value unless explicitly set.

Deprecated:Function usage after aggregates v1.175.0

The use of eventInternals() after the first aggregate function in a query is deprecated and will be made unavailable in version 1.189.0 and onwards.

Note

The eventInternals() function must be used before any aggregate function, otherwise the storage location will not be returned.

Click + next to an example below to get the full details.

Count Events From Each Datasource

Count events from each datasource by using eventInternals() function to add storage location to each event

Query
logscale
eventInternals()
| groupBy([@datasourceId])
Introduction

The eventInternals() function is used to add the storage locations of this event. The eventInternals() function augments the event data with the event field count information.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    eventInternals()

    Adds a @datasourceId field describing the storage locations of the event.

  3. logscale
    | groupBy([@datasourceId])

    Groups the events based on the @datasourceId, performs a count of the events and returns the results in a _count field.

  4. Event Result set.

Summary and Results

The query is used to find the number of events per datasource.