chgname search command
This topic contains the following information:
For a list of all search commands, see Search commands.
Syntax
chgname <Source-Field> with <Target-Field>+
chgname <Source-Field> with "<Phrase>"+
In the preceding syntax, the following definitions apply:
+
indicates one or more similar expressions separated by a comma (,) or space.<Source-Field>
refers to the field that you want to rename.<Target-Field>
refers to the new field name with which you want to replace the existing field name."<Phrase>"
refers to the phrase with which you want to replace the existing field name. You must enclose a phrase in double quotes (").
Short examples
Example 1: Rename the COMPID field with ComponentID:
... | chgname COMPID with ComponentID
Example 2: Rename the COMPID field with the phrase Component ID:
... | chgname COMPID with "Component ID"
Long example
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the chgname
command.
Sample data
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
Sample indexed data
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
chgname for multiple fields
In this example, you use the command to replace an existing field name with a new field name. See sample indexed data to understand how this command functions and to correlate the resulting output:
Command
... | chgname RequestType with REQUEST_TYPE, ResponseSize with "RESPONSE SIZE"
Output
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |REQUEST_TYPE=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |REQUEST_TYPE=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png |
Notes
- After replacing the name of a particular field with a new name, you cannot search for the new name.
You cannot rename an existing (single) field with multiple names. For example, with an existing field X, you cannot replace X with Y and then replace X with Z in one search string.
Example of an invalid syntax ... | chgname COMPID with site,
COMPID
with reportYou cannot rename the default fields HOST, COLLECTOR_NAME, and DATA_PATTERN.
- You cannot use default field names to specify a target field.
- You cannot click a renamed field (or tag) to add it to the Fields section (on the Filters panel) or to your search criteria. However, you can use it in a subsequent search command by adding it to your search criteria.
Comments
Log in or register to comment.