put

Set the specified field of each point to the result of an expression, optionally computed over a moving time window.

put [-over duration]
  [-reset true|false]
  fieldname1=expr1 [, fieldnameN=exprN]
  [by field1, [field2, ...]]

Parameter	Description	Required?
`-over`	The moving time window over which the value will be computed, as a duration literal. If `-over`is :forever:, the results are cumulative, over all points seen so far. See Moving time windows for more information about moving time windows.	No; if `-over`is not specified, all points since the beginning of the current batch are used
`-reset`	Set this to 'false' to emit results cumulatively, over all points seen so far, when a reducer expression is present (by default, a reducer in a batched flow will be reset at the beginning of each batch).	No
`fieldname=expr`	Set the field named fieldname to the value specified by expr, where expr can be a literal value, an arithmetic expression, a function invocation, or a reducer invocation	Yes
`by`	One or more fields by which to group. See Grouping fields with by.	No

See Field referencing for more about this syntax.

Example: Set the field foo of every point to 5

emit -limit 5 
| put foo = 5 
| view table

Example: Set the field foo to 5 and the bar field to "string" for every point

emit -limit 5 
| put foo = 5, bar = "string" 
| view table

Example: Set the field foo to the value of the field bar multiplied by 10

emit -limit 5 
| put bar = count(), foo = bar * 10 
| view table

Set the field foo of every point to a random number between 0 and 1

emit -limit 5
| put foo = Math.random() 
| view table

Example: Superimposing yesterday's CPU usage over today's

// Day over Day graph example:
//
// display a graph of cpu usage superimposed over the previous day
// by using a moving window to get the value from 24 hours ago.
//
// The graph will begin at 2014-01-01, but we need to start the data
// source a day earlier so the windowed reducer can produce a point
// for 2014-01-01
//
read stochastic -source 'cdn' -from :2013-12-31: -to :2014-01-05: -daily .5 -source_type 'metric' name = 'cpu'
| reduce 
    -every :2h: value = avg(value)
| put 
    -over :25h: prev = first(value)
| filter time >= :2014-01-01: // discard unfilled window points from Dec.
| split value,prev
| view timechart