...

Changes the display names, formats, and/or formats of columnor time units of column(s) in the summary table resulting from the complex search(es) preceding the pipe character.

...

Description: The display format of the column header values in the summary table. See Format.

"OutputInput_Unit"

Syntax: Volume Units - B, KB, MB, GB; Time Units: microsec, ms, sec, min, hour, day

 Description: The output units The input unit of the column valuesvalue. If only one unit appears in the syntax, XpoLog assumes that it is the output unit, and that the input value is in milliseconds (for time) or bytes (for volume).

"InputOutput_Unit"

Syntax: Volume Units - B, KB, MB, GB; Time Units: microsec, ms, sec, min, hour, day

 Description: The output units of The unit in which to convert the column values. If only one unit appears in the syntax, XpoLog assumes that it is the output unit, and that the input value is in milliseconds (for time) or bytes (for volume).

Description

For each event that has the specified column name, does the following, as If no unit appears in the syntax, XpoLog outputs the log value in milliseconds (for time) or bytes (for volume).

Description

In the summary table resulting from the complex search, does any or all of the following for each column name specified:

• Changes the column name to the to a new column name,
• Changes the format of the column name to the specified format.

...

• .
• Assumes that the format of the column is the specified format.
• Assumes that the output unit of the column values is the specified unit.
• Assumes that the input unit of the column values is the specified unit, and converts it to the output unit specified.

The display of several columns in the summary table of a complex search can be changed by placing them in a comma-separated list.

Examples

Example 1:  

...

* in log.access | count , avg Bytes Sent | group by url | display avg as Average Bytes in volume format

 Show For each URL in the access log events, show the number of log access events that have Column_X, and in the table change the display name of Column_X to Column_Y.events and the average of the Bytes Sent column. In the table, replace the avg header with Average Bytes, and show the values in volume format in Bytes (default).

 Example 2:  

* in log.access | avg time counttaken | display Volume_Interval_Columnavg in volumetime format ("Output_Unit"(“SEC”,”MIN”) 

 Assumes  In the access log events, calculate the average of the time taken column values, assume that the input value in Volume_Interval_Column is in bytesseconds, and convert and displays display it in Output_Unit format. Optional volume units are B, KB, MB, and GB minutes.