Page tree
Skip to end of metadata
Go to start of metadata
This search command replaces the value of a specified field (or field list) with new values. This command is useful when you have multiple fields with the same value and you want to change that value to a new value.

This topic contains the following information:

For a list of all search commands, see Search commands.

Syntax

chgvalue <Existing-String> with <New-String>

chgvalue <Existing-String> with <New-String> [in <Field-List>]+

In the preceding syntax, the following definitions apply:

  • + indicates one or more similar expressions separated by a comma (,).
  • [Expression] indicates it is optional.
  • <Existing-String> refers to the existing value of the specified field or fields that you want to change.

  • <New-String> refers to the new value with which you want to replace the existing value. If the new string is a phrase, enclose it in double quotes (").
  • <Field-List> refers to a comma- or space-separated list of field names. If you do not specify a list of field names, by default the command replaces the value of all fields with the existing string.

Short examples

Example 1: Replace a value with a new value in a single specified field:

... | chgvalue INFO with info in debuglevel 

Example 2: Replace a value with a new value in multiple specified fields:

... | chgvalue INFO with info in debuglevel, errorlevel 

Example 3: Replace multiple values of a field with more descriptive names in single specified fields:

... | chgvalue INFO with info , ERRROR with error in debuglevel 

Example 4: Replace multiple values of a field with more descriptive names in multiple specified fields:

... | chgvalue INFO with info , ERRROR with error in debuglevel, errorlevel 

Example 5: Replace multiple values with new values in all fields:

... | chgvalue INFO with info , ERRROR with error 

Example 6: Replace a phrase value with a new value in a single specified field:

... | chgvalue "Error log " with error in debuglevel

Long example

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the chgvalue command.

Sample data

10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100

Back to examples ↑

Sample indexed data

10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100
HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png

Back to examples ↑

chgvalue for multiple fields

In this example, you use the command to replace the value of a particular field with a new value.

Command

... | chgvalue GET with get, POST with post

Output

10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100
HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=post |RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200
HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150
HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=get |RequestURL=/themes/ComBeta/images/bullet.png
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100
HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=get |RequestURL=/themes/ComBeta/images/bullet.png

Back to examples ↑

Note

After replacing the value of a particular field with a new value, you cannot search for the new value.