Hi,
My search is like given below and my column names are source file names. As the source file name consists of directory name, timestamp etc, it is too long to be a column name. I have extracted another field log_name with just the name of the source file without any time stamp or other stuffs. but how can i use the log_name variable in the search so that i can replace the source file name with log name.
I know that, there is an alternative idea of extracting the log_name during search time but i don't want the search to be some more lengthy, so i didn't do that. I am curious to know whether there is any other alternative for the same.
Search Query :
index=main source="$sources$"
| stats values(wrkf) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(reponame) as "Repo Name", values(version) as "Version", values(mode) as "Mode",values(order) as "Order"
|transpose
|rename column as Properties, "row 1" as "$sources$"
|appendcols [ search index=main source="$sourcessecond$"
| stats values(wrkf) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(reponame) as "Repo Name", values(version) as "Version", values(mode) as "Mode",values(order) as "Order"
|transpose |rename column as Properties, "row 1" as "$sourcessecond$"]
|where '$sources$'!= '$sourcessecond$'
Please Help
Thank You
If you have extracted a field named log_name
, you can use it in the search like any other field. For example,
index=main log_name=whatever
thanks lguinn !!! but how can i replace it instead of $sources$ and $sourcessecond$ in
|rename column as Properties, "row 1" as "$sourcessecond$"]
|where '$sources$'!= '$sourcessecond$'
Hi - I have something similar. I was curious to see if you were able to figure it out? I am extracting the action from the logs using regex. Then timecharting. i have three actions listed and i wanted to rename the column headers.
Search is:
index=app_example
sourcetype=provision_example
|rex field=_raw "(?logErrorResult\s+[\d+]+:[A-Za-z\s+]+\s+)"
|search action="*"
|timechart span=1d count by action
So displayed is showing something like the following:
_time action results (code #1) action results (code #2) action results (code #3)
2015-01-28 Rename to User Failure Rename to System Failure Rename to User/System
I want to rename the code # to the message listed below.
Thanks!