chgname search command
This topic contains the following information:
For a list of all search commands, see Search-commands.
Syntax
chgname <Source-Field> with <Target-Field>+
chgname <Source-Field> with "<Phrase>"+
In the preceding syntax, the following definitions apply:
- + indicates one or more similar expressions separated by a comma (,) or space.
- <Source-Field> refers to the field that you want to rename.
- <Target-Field> refers to the new field name with which you want to replace the existing field name.
- "<Phrase>" refers to the phrase with which you want to replace the existing field name. You must enclose a phrase in double quotes (").
Short examples
Example 1: Rename the COMPID field with ComponentID:
Example 2: Rename the COMPID field with the phrase Component ID:
... | chgname COMPID with "Component ID"
{{/code}}
Long example
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the chgname command.
Sample data
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
Sample indexed data
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
chgname for multiple fields
In this example, you use the command to replace an existing field name with a new field name. See sample indexed data to understand how this command functions and to correlate the resulting output:
Command
Output
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |REQUEST_TYPE=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |REQUEST_TYPE=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png |
Notes
- After replacing the name of a particular field with a new name, you cannot search for the new name.
You cannot rename an existing (single) field with multiple names. For example, with an existing field X, you cannot replace X with Y and then replace X with Z in one search string.
- You cannot rename the default fields HOST, COLLECTOR_NAME, and DATA_PATTERN.
- You cannot use default field names to specify a target field.
- You cannot click a renamed field (or tag) to add it to the Fields section (on the Filters panel) or to your search criteria. However, you can use it in a subsequent search command by adding it to your search criteria.