This topic contains the following information:
For a list of all search commands, see Search commands.
filter <filter-function>
In the preceding syntax, <filter-function>
can be one of the functions described in the following table:
Function | Syntax | Description |
---|---|---|
isNotNull | isNotNull (<field>) | Uses the field name as an argument and returns true if the field specified is not null (the field exists). Note: This function is expected to be deprecated in a future release of the IT Data Analytics product. If you are using this function in one of your saved searches, ensure that you update the saved searches and replace the |
fieldexists | fieldexists (<field>) | Uses the field name as an argument and returns true if the field specified is present in the data indexed. In other words, if the field specified exists in the data indexed, data containing the field is displayed as search results. On the other hand, if the field specified does not exist, no results are displayed. |
match | match (<field>, "<string>") | Uses two arguments: the field name as the first argument and a quoted string as the second argument. Returns true if the field value matches the second argument value irrespective of case. |
matchcase | matchcase (<field>, "<string>") | Uses two arguments: the field name as the first argument and a quoted string as the second argument. Returns true if the field value matches the exact argument value (case is important). |
isNumeric | isNumeric (<field>) | Uses the field name as an argument and returns true if the field value is numeric. This function works only for numeric values stored as a string at the time of data-pattern creation. |
greaterthan | greaterthan (<field>, "<numeric-value>") | Uses the field name as an argument and returns true if the field value is greater than the value specified. |
lessthan | lessthan (<field>, "<numeric-value>") | Uses the field name as an argument and returns true if the field value is less than the value specified. |
regex | regex (<field>, "<regex>") | Uses two arguments: the field name as the first argument and a quoted string (a Java regular expression) as the second argument. Returns true if the field value matches the second argument value. |
where,
|
Example 1: Filter search results containing numeric values for the field ResponseCode.
... | filter fieldexists(ResponseCode)
Example 2: Filter search results that do not contain the field Thread.
... | filter fieldexists(Thread)
Example 3: Filter search results matching the field RequestType with the value GET in a case-insensitive way.
... | filter match(RequestType, "GET")
Example 4: Filter search results matching the field RequestType with the value GET in a case-sensitive way.
... | filter matchcase(RequestType, "GET")
Example 5: Filter search results to display the field RequestType with the value matching the regular expression "...."
.
... | filter regex(RequestType, "....")
Example 6: Filter search results for the field ResponseCode with a value greater than 400.
... | filter greaterThan(ResponseCode, "400")
Example 7: Filter search results for the field ResponseCode with a value less than 400.
... | filter lessThan(ResponseCode, "400")
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the filter
command.
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
In this example, you use the command to display search results containing numeric values for the field ResponseCode.
... | filter isNumeric(ResponseCode)
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=200 |DATA_PATTERN=MyAccess |RequestType=POST |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=201 |DATA_PATTERN=MyAccess |RequestType=PUT |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=201 |DATA_PATTERN=MyAccess |RequestType=GET |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=404 |DATA_PATTERN=MyAccess |RequestType=GET |
In this example, you use the command to display search results containing the field invalidField.
If the specified field does not exist in the indexed data, no results are displayed.
... | filter fieldexists(invalidField)
No results found |
In this example, you use the command to display search results matching the field RequestType with the value GET.
... | filter match(RequestType, "GET")
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=201 |DATA_PATTERN=MyAccess |RequestType=GET |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=404 |DATA_PATTERN=MyAccess |RequestType=GET |
In this example, you use the command to display search results if the value of the field RequestType matches the regular expression specified.
... | filter regex(RequestType, "....")
In the following output, only results in which the value of the field RequestType contains four characters are displayed according to the regular expression used in the command.
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=200 |DATA_PATTERN=MyAccess |RequestType=POST |
In this example, you use the command to display search results in which the value of the field ResponseCode is greater than the value 400.
... | filter greaterThan(ResponseCode, "400")
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ResponseCode=404 |DATA_PATTERN=MyAccess |RequestType=GET |
In this example, you use the command to display search results in which the value of the field ResponseCode is less than the value 400.
... | filter lessThan(ResponseCode, "400")
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
isNumeric
function works only for numeric values stored as a string at the time of data-pattern creation.