table
Retrieves the data stored in the table.
Syntax
table [OPTIONS] meta("KEY_VALUE_EXPR"[, "TABLE", ... ])
Required Parameter
TABLE, ...
-
List of tables, separated by a comma (
,
). -
If you put a question mark (
?
) after the table name, no error occurs even if the table does not exist. For example, thetable test
query fails if test table does not exist. But if you execute the querytable test?
, the query returns an empty result without an error. -
You can use a wildcard (
*
) in the table name. For example, if you execute the query commandtable sys_*
, all tables starting withsys_
are retrieved. Tables that you do not have read permissions for are excluded from the search. After executing a query, you can see the table name in the _table field. meta("KEY_VALUE_EXPR"[, "TABLE", ...])
-
Metadata of the table to look up. The
meta()
function returns tables that match attributes specified by the KEY_VALUE_EXPR option.KEY_VALUE_EXPR
- Comparison expression in the form of
"KEY == VALUE"
or"KEY != VALUE"
. You can use it with logical operators such asand
oror
, or with thenot
unary negation operator. KEY
- Key name of the table metadata
VALUE
- Value of the table metadata (a wildcard pattern can be used)
[ "TABLE", "TABLE", ... ]
- Table name of the table with names containing specific string patterns. If you don't specify the table, the command attempts to execute a metadata conditional expression on every table.
-
For ENT and STD, you can specify table metadata in TABLE > (Select a table) [General]. The metadata key for parser settings is
logparser
.
Optional Parameter
If you do not use duration
, from
or to
, all logs are searched.
duration=INT{mon|w|d|h|m|s}
- Time range to search the previous data based on the current time. You can specify the time in units of
mon
(month),w
(week),d
(day),h
(hour),m
(minute), ands
(second). For example,10s
refers to "the last 10 seconds" based on the time the query is executed. This option cannot be used withfrom
,to
orwindow
. from=yyyyMMddHHmmss
- Start date and time of the search period in the form of
yyyyMMddHHmmss
. The time period for the search includes the specified time point. If you provide only the first part, the command recognizes the remaining digits as0
. For example, if you provide20130605
, the command recognizes it as20130605000000
(June 5, 2013, 00:00:00). This option can be used withto
, but cannot be used withduration
andwindow
. to=yyyyMMddHHmmss
- End date and time of the search period in the form of
yyyyMMddHHmmss
. The time period for the search does not include the specified time point. The input format is the same asfrom
. This option can be used withfrom
, but cannot be used withduration
andwindow
. window=INT{y|mon|w|d|h|m|s}
- Period of time for which to receive data in real time from the time the query is executed. You can specify the time in units of
y
(year),mon
(month),w
(week),d
(day),h
(hour),m
(minute), ands
(second). When the unit isy
, only1y
is allowed. For example, 10s refers to "the next 10 seconds" from the time the query was executed. This option cannot be used withduration
,from
orto
. limit=INT
- Maximum number of records to load (default: unlimited).
offset=INT
- Number of records to skip (default:
0
). order=STR
- Sorting order of the records (default:
desc
).asc
: Sorts in ascending order, the oldest at the top.desc
: Sortes in descending order, the latest records at the top.
Usage
-
Read the last 100 logs from the
sys_cpu_logs
tabletable limit=100 sys_cpu_logs
-
Read logs for the last 10 minutes from the
sys_cpu_logs
table.table duration=10m sys_cpu_logs
-
Read all logs corresponding to the date of June 5, 2013, from the
sys_cpu_logs
table.table from=20130605 to=20130606 sys_cpu_logs
-
Read all logs from the
sys_cpu_logs
andsys_mem_logs
tables in sequence.table sys_cpu_logs, sys_mem_logs
-
Read data from tables which have
parser
metadata with the value ofopenssh
.table meta("parser==openssh")