Allow any field expression syntax to be used in columns
Allow anything that can be used in a display filter to be used in columns (with the exception that field references don't work without a notion of a currently selected frame): display filter functions, slices, arithmetic calculations, logical tests, raw byte addressing, the layer modifier, display filter macros, etc., alone or in combination.
Show the results and generate filters. Note that "resolved" values are not yet supported. They make conceptual sense for some expressions (e.g., if the layer modifier only is used) but not for others. Perhaps resolution could be done as a final step in the filter before returning values.
It would also be useful to be able to get the expected return type of an expression, so that the functions for right justifying a column or sorting numerically could work. Right now the results are treated as strings even if the return field values are numeric.
Multifield columns (i.e., concatenation of field values) are currently implemented using the OR operator.For backwards compability, continue to support that. When a true logical OR would give a different result, surround the expression in parentheses, which the multifield columns did not previously support (due to the regex used instead of full filter grammar parsing.)
Perhaps in the future we should introduce a separate operator for concatenation, possibly only used in column definitions and nowhere else.
Update release notes.
Fix #7752 (closed). Fix #10154 (closed). Fix #15990 (closed). Fix #18588 (closed). Fix #19076 (closed). Related to #16181 - it's now possibly to define new display filter functions so that is essentially solved, though I suppose there's always room for more built-in functions.
Merge request reports
Activity
added 22 commits
-
8d85384f...41930060 - 19 commits from branch
wireshark:master - 68ddc954 - column: Update custom column regex
- 293890ff - Show other custom column types
- 22ce5dbc - Add filters as well
Toggle commit list-
8d85384f...41930060 - 19 commits from branch
added 16 commits
-
34ff0f45...285f9ec6 - 15 commits from branch
wireshark:master - 88f01933 - columns: Allow any field expression syntax to be used in columns
-
34ff0f45...285f9ec6 - 15 commits from branch
added 9 commits
-
88f01933...19904e94 - 8 commits from branch
wireshark:master - 49540ec6 - columns: Allow any field expression syntax to be used in columns
-
88f01933...19904e94 - 8 commits from branch
951 951 header_field_info *hfi = proto_registrar_get_byname(custom_field); 952 952 if (hfi == NULL) { 953 953 /* Not a valid field */ 954 dfilter_t *dfilter; 955 if (dfilter_compile(custom_field, &dfilter, NULL)) { 956 dfilter_free(dfilter); 957 return ws_strdup_printf("Expression: %s", custom_field); 958 } 954 959 return ws_strdup_printf("Unknown Field: %s", custom_field);
