×
 
 
  •  
$helper.renderConfluenceMacro('{bmc-global-announcement:$space.key}')
BMC TrueSight IT Data Analytics 11.0 ... Using Search commands

valmap search command

This search command classifies numeric field values with a specified category name depending on the range specified. This command adds a new field, range, that is assigned the category name if the numeric values fall in the specified range.

The ranges that you specify can overlap. If you have overlapping values, all relevant categories are displayed as the value of the range field. For example, if light=1-12, heavy=7-15, and the input field value specified in the search command is 10, then range=light,heavy.

You can also categorize a value if it does not fall into the range specified by using the default parameter.

This topic contains the following information:

Related topics

eval search command

Getting started with search

Syntax

valmap field=<fieldName> (<CategoryName1>=<StartingRange>-<EndingRange>)+ [default=<string>]

In the preceding syntax, the following definitions apply:

  • + indicates one or more similar expressions separated by a space ( ).
  • [expression] indicates it is optional.
  • <fieldName> refers to the field (with numeric value) to be used for categorizing the value.
  • <CategoryName1> refers to the category name that you want to display as the value of the range field when the range criteria is met. The range field is newly added when you run this command.
  • <StartingRange> refers to the starting integer value in the range.
  • <EndingRange> refers to the ending integer value in the range.
  • [default=<DefaultCategory>] refers to the default category. If the field value does not fall in the specified range, then you can replace the value of the  range field with the specified (default) category name.

Short examples

Example 1: Depending on the value of the ResponseSize field, assign the following categories:

  • light_load: If the value is between 100-149.
  • mid_load: If the value is between 150-199.
  • heavy_load: If the value is between 200-400.
... | valmap field=ResponseSize light_load=100-149 mid_load=150-199 heavy_load=200-400

Example 2: Depending on the value of the ResponseSize field, assign the following categories:

  • light_load: If the value is between 100-129.
  • mid_load: If the value is between 130-159.
  • heavy_load: If the value is between 160-199.
  • unknown_load: If no range matches (for example, if ResponseSize=10).
... | valmap field=ResponseSize light_load=100-129 mid_load=130-159 heavy_load=160-199 
default=unknown_load

Example 3: Depending on the value of the ResponseSize field, assign the following categories:

  • light_load: If the value is between 100-200.
  • mid_load: If the value is between 150-300.
  • heavy_load: If the value is between 300-400.
... | valmap field=ResponseSize light_load=100-200 mid_load=150-300 heavy_load=300-400

Long example

 The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the valmap command.

Sample data 

10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100

Back to examples ↑

Sample indexed data

10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100
HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png

Back to examples ↑

Categorize field values for absolute ranges

In this example, you use the command to categorize values of the ResponseSize field as light_load, mid_load, and heavy_load.

Command

... | valmap field=ResponseSize light_load=100-149 mid_load=150-199 
heavy_load=200-400

Output

10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100
HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
HOST=local.bmc.com |range=heavy_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=heavy_load
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
HOST=local.bmc.com |range=mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=mid_load
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load

Back to examples ↑

Categorize field values that fall in the given range and outside the range

In this example, you use the command to categorize values of the ResponseSize field as light_load, mid_load, and heavy_load and assign the values falling out of the specified range as unknown_load.

Command

... | valmap field=ResponseSize light_load=100-129 mid_load=130-159 
heavy_load=160-199 default=unknown_load

Output

10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100
HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
HOST=local.bmc.com |range=unknown_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=unknown_load
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
HOST=local.bmc.com |range=mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=mid_load
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load

Back to examples ↑

Categorize field values for overlapping ranges

In this example, you use the command to categorize overlapping values of the ResponseSize field as light_load, mid_load, and heavy_load, or a combination of all the three categories.

Command

... | valmap field=ResponseSize light_load=100-200 mid_load=150-300 
heavy_load=300-400

Output

10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100
HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
HOST=local.bmc.com |range=light_load,mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load,mid_load
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
HOST=local.bmc.com |range=light_load,mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load,mid_load
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load

Back to examples ↑

Notes

  • If the field for which thissearch command is applied does not exist in the data entry, the data entry is not modified.

  • If the value for a specified field does not fall in one of the ranges, then the No_Matching_Range category is displayed as the value of the range field.

Was this page helpful? Yes No Submitting... Thank you
Last modified by Sonali Deshmukh on Jan 10, 2017
examples search reference search_commands using

Comments

Log in or register to comment.

top search command
Analyzing data
© Copyright 2014-2017 BMC Software, Inc
Legal notices

Powered by Atlassian Confluence and Scroll Viewport

© Copyright 2005-2023 BMC Software, Inc. Use of this site signifies your acceptance of BMC’s Terms of Use . BMC, the BMC logo, and other BMC marks are assets of BMC Software, Inc. These trademarks are registered and may be registered in the U.S. and in other countries.