• Spaces
  • Collections
  • Help
    • ×
     
     
    •  
    BMC TrueSight IT Data Analytics 2.1

    Page tree

    This search command classifies numeric field values with a specified category name depending on the range specified. This command adds a new field, range, that is assigned the category name if the numeric values fall in the specified range.

    The ranges that you specify can overlap. If you have overlapping values, all relevant categories are displayed as the value of the range field. For example, if light=1-12, heavy=7-15, and the input field value specified in the search command is 10, then range=light,heavy.

    You can also categorize a value if it does not fall into the range specified by using the default parameter.

    This topic contains the following information:

    Related topics

    eval

    Searching the data

    Syntax

    valmap field=<fieldName> (<CategoryName1>=<StartingRange>-<EndingRange>)+ [default=<string>]

    In the preceding syntax, the following definitions apply:

    • + indicates one or more similar expressions separated by a space ( ).
    • [expression] indicates it is optional.
    • <fieldName> refers to the field (with numeric value) to be used for categorizing the value.
    • <CategoryName1> refers to the category name that you want to display as the value of the range field when the range criteria is met. The range field is newly added when you run this command.
    • <StartingRange> refers to the starting integer value in the range.
    • <EndingRange> refers to the ending integer value in the range.
    • [default=<DefaultCategory>] refers to the default category. If the field value does not fall in the specified range, then you can replace the value of the  range field with the specified (default) category name.

    Short examples

    Example 1: Depending on the value of the ResponseSize field, assign the following categories:

    • light_load: If the value is between 100-149.
    • mid_load: If the value is between 150-199.
    • heavy_load: If the value is between 200-400.
    ... | valmap field=ResponseSize light_load=100-149 mid_load=150-199 heavy_load=200-400

    Example 2: Depending on the value of the ResponseSize field, assign the following categories:

    • light_load: If the value is between 100-129.
    • mid_load: If the value is between 130-159.
    • heavy_load: If the value is between 160-199.
    • unknown_load: If no range matches (for example, if ResponseSize=10).
    ... | valmap field=ResponseSize light_load=100-129 mid_load=130-159 heavy_load=160-199 
    default=unknown_load

    Example 3: Depending on the value of the ResponseSize field, assign the following categories:

    • light_load: If the value is between 100-200.
    • mid_load: If the value is between 150-300.
    • heavy_load: If the value is between 300-400.
    ... | valmap field=ResponseSize light_load=100-200 mid_load=150-300 heavy_load=300-400

    Long example

     The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the valmap command.

    Sample data 

    10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 404 100
    10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 150
    10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 200
    10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 200 100

    Back to examples ↑

    Sample indexed data

    10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 200 100
    HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png
    10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 200
    HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png
    10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 150
    HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png
    10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 404 100
    HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png

    Back to examples ↑

    Categorize field values for absolute ranges

    In this example, you use the command to categorize values of the ResponseSize field as light_load, mid_load, and heavy_load.

    Command

    ... | valmap field=ResponseSize light_load=100-149 mid_load=150-199 
    heavy_load=200-400

    Output

    10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 200 100
    HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load
    10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 200
    HOST=local.bmc.com |range=heavy_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=heavy_load
    10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 150
    HOST=local.bmc.com |range=mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=mid_load
    10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 404 100
    HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load

    Back to examples ↑

    Categorize field values that fall in the given range and outside the range

    In this example, you use the command to categorize values of the ResponseSize field as light_load, mid_load, and heavy_load and assign the values falling out of the specified range as unknown_load.

    Command

    ... | valmap field=ResponseSize light_load=100-129 mid_load=130-159 
    heavy_load=160-199 default=unknown_load

    Output

    10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 200 100
    HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load
    10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 200
    HOST=local.bmc.com |range=unknown_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=unknown_load
    10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 150
    HOST=local.bmc.com |range=mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=mid_load
    10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 404 100
    HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load

    Back to examples ↑

    Categorize field values for overlapping ranges

    In this example, you use the command to categorize overlapping values of the ResponseSize field as light_load, mid_load, and heavy_load, or a combination of all the three categories.

    Command

    ... | valmap field=ResponseSize light_load=100-200 mid_load=150-300 
    heavy_load=300-400

    Output

    10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 200 100
    HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load
    10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 200
    HOST=local.bmc.com |range=light_load,mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load,mid_load
    10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 201 150
    HOST=local.bmc.com |range=light_load,mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load,mid_load
    10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
    HTTP/1.1" 404 100
    HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load

    Back to examples ↑

    Notes

    • If the field for which thissearch command is applied does not exist in the data entry, the data entry is not modified.

    • If the value for a specified field does not fall in one of the ranges, then the No_Matching_Range category is displayed as the value of the range field.

     

    2 Comments

    1. Surya Prakash Chinta

       

      1. Priyanka Nanwani

         

    © Copyright 2005-2024 BMC Software, Inc. Use of this site signifies your acceptance of BMC’s Terms of Use . BMC, the BMC logo, and other BMC marks are assets of BMC Software, Inc. These trademarks are registered and may be registered in the U.S. and in other countries.