chgvalue search command
This search command replaces the value of a specified field (or field list) with new values. This command is useful when you have multiple fields with the same value and you want to change that value to a new value.
This topic contains the following information:
For a list of all search commands, see Search-commands.
Related topics
Syntax
chgvalue <Existing-String> with <New-String>
chgvalue <Existing-String> with <New-String> [in <Field-List>]+
In the preceding syntax, the following definitions apply:
- + indicates one or more similar expressions separated by a comma (,).
- [Expression] indicates it is optional.
- <Existing-String> refers to the existing value of the specified field or fields that you want to change.
- <New-String> refers to the new value with which you want to replace the existing value. If the new string is a phrase, enclose it in double quotes (").
- <Field-List> refers to a comma- or space-separated list of field names. If you do not specify a list of field names, by default the command replaces the value of all fields with the existing string.
Short examples
Example 1: Replace a value with a new value in a single specified field:
... | chgvalue INFO with info in debuglevel
Example 2: Replace a value with a new value in multiple specified fields:
... | chgvalue INFO with info in debuglevel, errorlevel
Example 3: Replace multiple values of a field with more descriptive names in single specified fields:
... | chgvalue INFO with info , ERRROR with error in debuglevel
Example 4: Replace multiple values of a field with more descriptive names in multiple specified fields:
... | chgvalue INFO with info , ERRROR with error in debuglevel, errorlevel
Example 5: Replace multiple values with new values in all fields:
... | chgvalue INFO with info , ERRROR with error
Example 6: Replace a phrase value with a new value in a single specified field:
Long example
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the chgvalue command.
Sample data
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
Sample indexed data
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
chgvalue for multiple fields
In this example, you use the command to replace the value of a particular field with a new value.
Command
Output
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |ResponseSize=100 |RequestType=post |RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |ResponseSize=200 |RequestType=PUT |RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |ResponseSize=150 |RequestType=get |RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |ResponseSize=100 |RequestType=get |RequestURL=/themes/ComBeta/images/bullet.png |
Note
After replacing the value of a particular field with a new value, you cannot search for the new value.