chgname search command
This search command changes the name of one or more fields with new names that you specify. You can use this command to simplify your troubleshooting tasks by changing complex field names to meaningful names. By using this command, you can rename a given field or multiple fields. Multiple fields can be separated by using a comma (,) or a space.
This topic contains the following information:
For a list of all search commands, see Search-commands.
Related topics
Syntax
chgname <Source-Field> with <Target-Field>+
chgname <Source-Field> with "<Phrase>"+
In the preceding syntax, the following definitions apply:
- + indicates one or more similar expressions separated by a comma (,) or space.
- <Source-Field> refers to the field that you want to rename.
- <Target-Field> refers to the new field name with which you want to replace the existing field name.
- "<Phrase>" refers to the phrase with which you want to replace the existing field name. You must enclose a phrase in double quotes (").
Short examples
Example 1: Rename the COMPID field with ComponentID:
Example 2: Rename the COMPID field with the phrase Component ID:
... | chgname COMPID with "Component ID"
{{/code}}
Long example
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the chgname command.
Sample data
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
Sample indexed data
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
chgname for multiple fields
In this example, you use the command to replace an existing field name with a new field name. See sample indexed data to understand how this command functions and to correlate the resulting output:
Command
Output
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |REQUEST_TYPE=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |REQUEST_TYPE=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png |
Notes
- After replacing the name of a particular field with a new name, you cannot search for the new name.
You cannot rename an existing (single) field with multiple names. For example, with an existing field X, you cannot replace X with Y and then replace X with Z in one search string.
- You cannot rename the default fields HOST, COLLECTOR_NAME, and DATA_PATTERN.
- You cannot use default field names to specify a target field.
- You cannot click a renamed field (or tag) to add it to the Fields section (on the Filters panel) or to your search criteria. However, you can use it in a subsequent search command by adding it to your search criteria.