This search command classifies numeric field values with a specified category name depending on the range specified. This command adds a new field, range
, that is assigned the category name if the numeric values fall in the specified range.
The ranges that you specify can overlap. If you have overlapping values, all relevant categories are displayed as the value of the range
field. For example, if light=1-12, heavy=7-15, and the input field value specified in the search command is 10, then range=light,heavy.
You can also categorize a value if it does not fall into the range specified by using the default
parameter.
This topic contains the following information:
valmap field=<fieldName> (<CategoryName1>=<StartingRange>-<EndingRange>)+ [default=<string>]
In the preceding syntax, the following definitions apply:
+
indicates one or more similar expressions separated by a space ( ).<fieldName>
refers to the field (with numeric value) to be used for categorizing the value.<CategoryName1>
refers to the category name that you want to display as the value of the range
field when the range criteria is met. The range
field is newly added when you run this command.<StartingRange>
refers to the starting integer value in the range.<EndingRange>
refers to the ending integer value in the range.[default=<DefaultCategory>]
refers to the default category. If the field value does not fall in the specified range, then you can replace the value of the range
field with the specified (default) category name.Example 1: Depending on the value of the ResponseSize field, assign the following categories:
... | valmap field=ResponseSize light_load=100-149 mid_load=150-199 heavy_load=200-400
Example 2: Depending on the value of the ResponseSize field, assign the following categories:
... | valmap field=ResponseSize light_load=100-129 mid_load=130-159 heavy_load=160-199
default=unknown_load
Example 3: Depending on the value of the ResponseSize field, assign the following categories:
... | valmap field=ResponseSize light_load=100-200 mid_load=150-300 heavy_load=300-400
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the valmap
command.
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
In this example, you use the command to categorize values of the ResponseSize field as light_load, mid_load, and heavy_load.
... | valmap field=ResponseSize light_load=100-149 mid_load=150-199
heavy_load=200-400
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=heavy_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=heavy_load |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=mid_load |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load |
In this example, you use the command to categorize values of the ResponseSize field as light_load, mid_load, and heavy_load and assign the values falling out of the specified range as unknown_load.
... | valmap field=ResponseSize light_load=100-129 mid_load=130-159
heavy_load=160-199 default=unknown_load
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=unknown_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=unknown_load |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=mid_load |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load |
In this example, you use the command to categorize overlapping values of the ResponseSize field as light_load, mid_load, and heavy_load, or a combination of all the three categories.
... | valmap field=ResponseSize light_load=100-200 mid_load=150-300
heavy_load=300-400
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=POST |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load,mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load,mid_load |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load,mid_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load,mid_load |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |range=light_load|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=GET |RequestURL=/themes/ComBeta/images/bullet.png |range=light_load |
If the value for a specified field does not fall in one of the ranges, then the No_Matching_Range category is displayed as the value of the range field.