dfilter: Add vals (value string) function

Add a function to explicitly convert a field from its value to
the value string output. We do this implicitly with some filters
(i.e., comparing an integer type with a value string to a string),
but having an explicit function allows it to be nested with other
functions and operators, or used for custom fields.

1 files changed, 4 insertions, 0 deletions

diff --git a/docbook/wsug_src/wsug_work.adoc b/docbook/wsug_src/wsug_work.adoc
index 60e4dd012f..bd9220008b 100644
--- a/docbook/wsug_src/wsug_work.adoc
+++ b/docbook/wsug_src/wsug_work.adoc
@@ -956,6 +956,7 @@ The display filter language has a number of functions to convert fields, see
 |len     |Returns the byte length of a string or bytes field.
 |count   |Returns the number of field occurrences in a frame.
 |string  |Converts a non-string field to a string.
+|vals    |Converts a field value to its value string, if it has one.
 |dec     |Converts an unsigned integer field to a decimal string.
 |hex     |Converts an unsigned integer field to a hexadecimal string.
 |max     |Return the maximum value for the arguments.
@@ -989,6 +990,9 @@ To match IP addresses ending in 255 in a block of subnets (172.16 to 172.31):
 string(ip.dst) matches r"^172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.255"
 ----
 
+The `vals` function converts an integer or boolean field value to a string
+using the field's associated value string, if it has one.
+
 The functions max() and min() take any number of arguments of the same type
 and returns the largest/smallest respectively of the set.