Synopsis
Changes the display names, formats, and/or time units of column(s) in the summary table resulting from the complex search(es) preceding the pipe character.
Syntax
display [Result_Column_Name] (as [New _Column_Name]) (in [Format_Type] format)(["Input_Unit"],)(["Output_Unit"]) (, [RESULT_COLUMN_NAME] (as [NEW_COLUMN_NAME] )…)
Required Arguments
Result_Column_Name
Syntax: <character string>
Description: The name of the column header in the summary table resulting from the complex search, whose name, format, or output unit you want to change.
Optional Arguments
New_Column_Name
Syntax: <character string>
Description: The new display name of the column header in the summary table.
Format_Type
Syntax: time, volume, or regexp
Description: The display format of the column header values in the summary table. See format.
Description
In the summary table resulting from the complex search, does any or all of the following for each column name specified:
- Changes the column name to a new column name.
- Assumes that the format of the column is the specified format.
- Assumes that the output unit of the column values is the specified unit.
- Assumes that the input unit of the column values is the specified unit, and converts it to the output unit specified.
The display of several columns in the summary table of a complex search can be changed by placing them in a comma-separated list.
Examples
Example 1:
* in log.access | count , avg Bytes Sent | group by url | display avg as Average Bytes in volume format
For each URL in the access log events, show the number of log events and the average of the Bytes Sent column. In the table, replace the avg header with Average Bytes, and show the values in volume format in Bytes (default).
Example 2:
* in log.access | avg time taken | display avg in time format(“SEC”,”MIN”)
In the access log events, calculate the average of the time taken column values, assume that the input value is in seconds, and convert and display it in minutes.