Synopsis
Changes the display names and/or formats of column(s) in the summary table resulting from the complex search(es) preceding the pipe character.
Syntax
display [Result_Column_Name] (as [New _Column_Name]) (in [Format_Type] format)(["Input_Unit"],)(["Output_Unit"]) (, [RESULT_COLUMN_NAME] (as [NEW_COLUMN_NAME] )…)
Required Arguments
Result_Column_Name
Syntax: <character string>
Description: The name of the column header in the summary table resulting from the complex search, whose name, format, or output unit you want to change.
Optional Arguments
New_Column_Name
Syntax: <character string>
Description: The new display name of the column header in the summary table.
Format_Type
Syntax: <character string>
Description: The display format of the column header values in the summary table. See Format.
"Output_Unit"
Syntax: Volume Units - B, KB, MB, GB; Time Units: microsec, ms, sec, min, hour, day
Description: The output units of the column values.
"Input_Unit"
Syntax: Volume Units - B, KB, MB, GB; Time Units: microsec, ms, sec, min, hour, day
Description: The output units of the column values.
Description
For each event that has the specified column name, does the following, as specified:
- Changes the column name to the new column name,
- Changes the format of the column name to the specified format.
Several columns can be changed, by placing them in a comma-separated list.
Examples
Example 1:
* log.access | count | display Column_X as Column_Y
* in log.access | count , avg Bytes Sent | group by url | display avg as Average Bytes in volume format
Show the number of log access events that have Column_X, and in the table change the display name of Column_X to Column_Y.
Example 2:
* log.access | count | display Volume_Interval_Column in volume format ("Output_Unit") Assumes that the value in Volume_Interval_Column is in bytes, and displays it in Output_Unit format. Optional volume units are B, KB, MB, and GB