Available functions

Question 1

abschange

Answer 1

Returns absolute difference between last and previous values.
For strings:
0 - values are equal
1 - values differ

Question 2

avg

Answer 2

The average value of a period. The period is set in seconds or as a number of collected values (preceded by a # hash mark, for example, #5 - five latest values) in the first parameter.
The function accepts a second, optional parameter time_shift. It is useful when there is a need to compare the current average value with the average value time_shift seconds back. For instance, avg(3600,86400) will return the average value for an hour one day ago.

Question 3

change

Answer 3

Returns difference between last and previous values.
For strings:
0 - values are equal
1 - values differ

Question 4

count (sec or #num)

Answer 4

The number of collected values in a period. The period is set in seconds or as a number of values (preceded by a # hash mark) in the first parameter.
The function accepts a second optional pattern parameter, a third operator parameter, and a fourth time_shift parameter.
For pattern: integer items - exact match; float items - match within 0.000001
Supported operators *:
eq - equal
(as for test bash)
like - matches if contains pattern.
*For integer and float items: operators eq (default), ne, gt, ge, lt, le are supported.
*For string, text and log items: operators like (default), eq, ne are supported.
Examples:
count(600) - the number of values for last 10 minutes
count(600,12) - the number of values for last 10 minutes that equal ‘12’
count(600,12,”gt”) - the number of values for last 10 minutes that are over ‘12’

Question 5

date

Answer 5

Returns current date in YYYYMMDD format.

For example: 20031025

Question 6

dayofmonth

Answer 6

Returns day of month in range of 1 to 31.

Question 7

dayofweek

Answer 7

Returns day of week in range of 1 to 7. Mon - 1, Sun - 7.

Question 8

delta

Answer 8

Returns the difference between the maximum and minimum values in a period (‘max()’ minus ‘min()’). The period is set in seconds or as a number of collected values (preceded by a # hash mark) in the first parameter.
Since Zabbix 1.8.2, the function supports a second, optional parameter time_shift. See function avg() for an example of its use.

Question 9

diff

Answer 9

Returns:
1 - last and previous values differ
0 - otherwise

Question 10

fuzzytime

Answer 10

Returns 1 if timestamp (item value) does not differ from Zabbix server time for more than N seconds, 0 - otherwise.
Usually used with system.localtime to check that local time is in sync with local time of Zabbix server.

Question 11

iregexp (1st - string, 2nd - sec or #num)

Answer 11

This function is non case-sensitive analogue of regexp.

Question 12

last (sec or #num)

Answer 12

Last (most recent) value. Parameter:
sec - ignored
#num - Nth most recent value
Take note that #num, as can be expected, works differently here than with many other functions.
For example,
last(0) is always equal to last(#1)
last(#3) - third most recent value (not three latest values)
The function also supports a second optional time_shift parameter. For example,
last(0,86400) will return the most recent value one day ago.

Question 13

logeventid (string)

Answer 13

Check if Event ID of the last log entry matches a regular expression. Parameter defines the regular expression, POSIX extended style.
Returns:
0 - does not match
1 - matches

Question 14

logseverity

Answer 14

Returns log severity of the last log entry. Parameter is ignored.
0 - default severity
N - severity (integer, useful for Windows event logs: 1 - Information, 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit). Zabbix takes log severity from field Information of Windows event log.

Question 15

logsource (string)

Answer 15

Check if log source of the last log entry matches parameter.
0 - does not match
1 - matches
Normally used for Windows event logs. For example, logsource(“VMware Server”).

Question 16

min (sec or #num)

Answer 16

The minimum (lowest) value of a period. The period is set in seconds or as a number of collected values (preceded by a # hash mark) in the first parameter.
Since Zabbix 1.8.2, the function supports a second, optional parameter time_shift. See function avg for an example of its use.

Question 17

nodata (sec)

Answer 17

Returns:
1 - if no data received during period of time in seconds. The period should not be less than 30 seconds.
0 - otherwise

Question 18

now

Answer 18

Returns number of seconds since the Epoch (00:00:00 UTC, January 1, 1970).

Question 19

prev

Answer 19

Returns previous value. Parameter is ignored.

Same as last(#2)

Question 20

regexp (1st - string, 2nd - sec or #num)

Answer 20

Check if last (most recent) value matches regular expression. Parameter defines regular expression, POSIX extended style.
Second optional parameter is number of seconds or number of collected values to analyse. In this case more than one value will be processed.
This function is case-sensitive.
Returns:
1 - found
0 - otherwise

Question 21

str (1st - string, 2nd - sec or #num)

Answer 21

Find string in last (most recent) value. Parameter defines string to find. Case sensitive!
Second optional parameter is number of seconds or number of collected values to analyse. In this case more than one value will be processed.
Returns:
1 - found
0 - otherwise

Question 22

strlen (sec or #num)

Answer 22

Length of the last (most recent) value in characters (not bytes).
Parameters work the same as with ‘last’ function (see above in the table).
For example,
strlen(0) is equal to strlen(#1)
strlen(#3) - length of the third most recent value
strlen(0,86400) - length of the most recent value one day ago.

Question 23

sum (sec or #num)

Answer 23

The sum of collected values in a period. The period is set in seconds or as a number of values (preceded by a # hash mark) in the first parameter.

Question 24

time

Answer 24

Returns current time in HHMMSS format. Example: 123055