Then it pipes these events into the rename command to change the names of the coordinate fields, from lat and lon to latitude and longitude. This example begins with a search for all recent earthquakes in Northern California ( Region="Northern California"). Index=usgs_* source=usgs place=*California | rename lat as latitude lon as longitude | table time, place, lat*, lon*, mag Show the date, time, coordinates, and magnitude of each recent earthquake in Northern California. The data is a comma separated ASCII text file that contains magnitude (mag), coordinates (latitude, longitude), region (place), etc., for each earthquake recorded. This simply reformats your events into a table and displays only the fields that you specified as arguments.Įxample 2 This example uses recent earthquake data downloaded from the USGS Earthquakes website. Index=usgs_* source=usgs place=*California | table time, place, mag, depth Search for recent earthquakes in and around California and display only the time of the quake ( Datetime), where it occurred ( Region), and the quake's magnitude ( Magnitude) and depth ( Depth).
TABLE DISPLAYS DOWNLOAD
You can download a current CSV file from the USGS Earthquake Feeds and add it as an input to your Splunk deployment.
If truncate_report is set to 0, the max_count parameter is not applied.Įxamples Example 1 This example uses recent earthquake data downloaded from the USGS Earthquakes website. The number of results is controlled by the max_count parameter in the stanza. In the stanza, if the value for the truncate_report parameter is 1, the number of results returned is truncated. The table command truncates the number of results returned based on settings in the nf file. If you're going to rename a field, do it before piping the results to table. The table command doesn't let you rename fields, only specify the fields that you want to show in your tabulated results. If you are looking for a streaming command similar to the table command, use the fields command. The table command is a non-streaming command. To generate visualizations, the search results must contain numeric, datetime, or aggregated data such as count, sum, or average. The table command is a transforming command. For example, if you want to specify all fields that start with "value", you can use a wildcard such as value*.
You can use the asterisk ( * ) as a wildcard to specify a list of fields with similar names. The list can be space-delimited or comma-delimited. Description: A list of valid field names.
With the exception of a scatter plot to show trends in the relationships between discrete values of your data, you should not use the table command for charts. Use table command when you want to retain data in tabular format. The table command is similar to the fields command in that it lets you specify the fields you want to keep in your results. Columns are displayed in the same order that fields are specified. The table command returns a table that is formed by only the fields that you specify in the arguments.
0 kommentar(er)
