display only

Owned by Omry Koschitzky
Last updated: Oct 17, 2012
2 min read

Synopsis

Specifies the names of the column names resulting from the complex search that are to be displayed in the summary table, and optionally defines new display names, formats, and/or time units for these column name(s) in the summary table.

Syntax

display only [Result_Column_Name] (as [New _Column_Name]) (in [Format_Type] format)(["Input_Unit"],)(["Output_Unit"]) (, [RESULT_COLUMN_NAME] (as [NEW_COLUMN_NAME] )…)

Required Arguments

Result_Column_Name

Syntax: <character string>

Description: The column_names resulting from the complex search that you want to include in the displayed summary table.

Optional Arguments

New_Column_Name

Syntax: <character string>

Description: The new display name of the column header in the summary table.

 

Format_Type

Syntax: number, simple, time, date, volume, regexp, or expression

Description: The display format of the column header values in the summary table. See format.

Description

You may not be interested to display all the columns in a summary table that results from a complex search. Using display only, you can specify the column names that are to appear in the summary table, placing them in a comma-separated list.  

This function can also be used to change the display mode of any of these column names and/or values, by:

  • Changing the column name to a new column name.

  • Displaying the column values in a specified format.

  • Displaying the column values in a specified output unit.

  • Assuming that the input unit of the column values is the specified unit, and converting it to the specified output unit.

Examples

Example 1:  

* in log.access | count , avg Bytes Sent | group by url | display only avg as Average Bytes in volume format

For each URL in the access log events, calculates the number of log events and the average of the Bytes Sent column. In the resulting table, only shows the avg column, replacing the avg header with Average Bytes, and shows the values in volume format in Bytes (default).

 Example 2:  

* in log.access | avg time taken | display only avg in time format(“SEC”,”MIN”) 

In the access log events, calculates the average of the time taken column values. In the resulting table, only shows the avg column, and assumes that the input value is in seconds, and converts and displays it in minutes.