Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 5 Next »

Synopsis

Changes the display name and/or format of specified columns in the table resulting from the complex search.

Syntax

display [Result_Column_Name] (as [New _Column_Name]) (in [Format_Type] format)  (, [RESULT_COLUMN_NAME] (as [NEW_COLUMN_NAME] )…)

Required Arguments

Result_Column_Name

Syntax: <character string>

Description: The name of the column header in the resulting events whose name and/or format you want to change in the resulting summary table.

Optional Arguments

New_Column_Name

Syntax: <character string>

Description: The new name of the column header displayed in the summary table.

Format_Type

Syntax: <character string>

Description: The new format of the column header values. This can be any of the following formats:

  • number  –  format the text in the column to number format : (“#.##”) – the decimal format of the number
  • simple – display columns in different format : (“column.name1 – column.name2”) – replace the columns with the values from the result
  • time – display the value in a time format way: (“[OUTPUT_UNIT]”) , (“[INPUT_UNIT] “,“[OUTPUT_UNIT]”) – display the column in output format and use input unit In case it is different from milliseconds.
    Time units: [microsec,ms,sec,min,hour,day]
  • date – display the value in day format: (“[SIMPLE DATE FORMAT]”) – change the date format
  • volume – display the value in the volume format way: (“[OUTPUT_UNIT]”) , (“[INPUT_UNIT] “,“[OUTPUT_UNIT]”) – display the column in output format and use input unit in case it is different from bytes.
    Volume units: [B,KB,MB,GB]
  • regexp – use regexp to extract values from the data: (“[REGEXP]”) – display the first group that is found from the regular expression
  • expression – use the expression to make a calculation on a column result: (“[EXPRESSION]”) – use an expression to calculate different result value

Description

For each event that has the specified column name, does the following, as specified:

  • Changes the column name to the new column name,
  • Changes the format of the column name to the specified format.

Several columns can be changed, by placing them in a comma-separated list.

Examples

Example 1:  

* log.access | count | display Column_X as Column_Y

 In log access events, change the display name of Column_X to Column_Y.

Example 2:  

* log.access | count | display Volume_Interval_Column in volume format ("Output_Unit") 

 Assumes that the value in Volume_Interval_Column is in bytes, and displays it in Output_Unit format. Optional volume units are B, KB, MB, and GB

  • No labels