chgvalue search command
This topic contains the following information:
For a list of all search commands, see Search commands.
Syntax
chgvalue <Existing-String> with <New-String>
chgvalue <Existing-String> with <New-String> [in <Field-List>]+
In the preceding syntax, the following definitions apply:
+
indicates one or more similar expressions separated by a comma (,).- [Expression] indicates it is optional.
<Existing-String>
refers to the existing value of the specified field or fields that you want to change.
<New-String>
refers to the new value with which you want to replace the existing value. If the new string is a phrase, enclose it in double quotes (").<Field-List>
refers to a comma- or space-separated list of field names. If you do not specify a list of field names, by default the command replaces the value of all fields with the existing string.
Short examples
Example 1: Replace a value with a new value in a single specified field:
... | chgvalue INFO with info in debuglevel
Example 2: Replace a value with a new value in multiple specified fields:
... | chgvalue INFO with info in debuglevel, errorlevel
Example 3: Replace multiple values of a field with more descriptive names in single specified fields:
... | chgvalue INFO with info , ERRROR with error in debuglevel
Example 4: Replace multiple values of a field with more descriptive names in multiple specified fields:
... | chgvalue INFO with info , ERRROR with error in debuglevel, errorlevel
Example 5: Replace multiple values with new values in all fields:
... | chgvalue INFO with info , ERRROR with error
Example 6: Replace a phrase value with a new value in a single specified field:
... | chgvalue "Error log " with error in debuglevel
Long example
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the chgvalue
command.
Sample data
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
Sample indexed data
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
chgvalue for multiple fields
In this example, you use the command to replace the value of a particular field with a new value.
Command
... | chgvalue GET with get, POST with post
Output
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=post |RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=get |RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=get |RequestURL=/themes/ComBeta/images/bullet.png |
Note
After replacing the value of a particular field with a new value, you cannot search for the new value.
Comments
Log in or register to comment.