The SHOW Clause

The SHOW clause contains a list of columns to return in the search results. The clause is a comma separated list of attribute names, key expressions, functions or other expressions. For some reports, it is useful to set headings for the columns. By default, the heading for a column is the name of the attribute in that column, or a simple string describing how the value was arrived at. The default heading can be overridden with the AS modifier:

SEARCH Host SHOW name AS "Host name", os AS "Operating system"

If the SHOW clause is absent, the columns are set according to the summary list as defined in the taxonomy. If the SHOW clause is a single * character, the columns are set to the field order defined in the taxonomy. In both of those cases, if there is no entry in the taxonomy for the node kinds, no columns are set, and results can not be retrieved (although the nodes themselves can still be accessed).

To show the taxonomy-defined summary list defined plus some other attributes, use the SUMMARY keyword in a SHOW clause. This query shows the OS of a Host, followed by the normal taxonomy summary:

SEARCH Host SHOW os, SUMMARY

If columns are not named with AS, the columns are named using information from the taxonomy, as long as the locale is known. Searches performed through the UI take the locale from the user's profile information. In other cases, such as exports, there is no default locale. The locale can be specified in the query:

SEARCH Host LOCALE "en_GB" SHOW name, os

If the locale is not known, or is is specified as the empty string, the column headings are based on the attribute names in the SHOW clause.