Skip to main content Link Search Menu Expand Document (external link)

Extraction - f

Table of contents
  1. f


• f(“resourceName”)

The command f is the core function of the FPL language. Fields can be extracted from resources and system log using this function.

sip = f("sip") 


 {userID, workload} = f("@office365")

For a resource which has a multiple-layer structure, the “resourceName” inside the f must be the nearest category to the variable you want. For example:

let {agentID} = f("@sentinelOneAgent.translation")

In this example, “agentID” is in the category of “translation”. If one tries let {agentID} = f("@sentinelOneAgent"), there would be an error.

f can be used for multiple times to extract more than one variables, but it must be placed before the data processing commands. Generally, if the code is started with search pipe, the order is: search-f-data processing.