table

Retrieves the data stored in the table.

Syntax

table [OPTIONS] TABLE[, ... ]

table [OPTIONS] meta("KEY_VALUE_EXPR"[, "TABLE", ... ])
Required Parameter
TABLE, ...

List of tables, separated by a comma (,).

If you put a question mark (?) after the table name, no error occurs even if the table does not exist. For example, the table test query fails if test table does not exist. But if you execute the query table test?, the query returns an empty result without an error.

You can use a wildcard (*) in the table name. For example, if you execute the query command table sys_*, all tables starting with sys_ are retrieved. Tables that you do not have read permissions for are excluded from the search. After executing a query, you can see the table name in the _table field.

meta("KEY_VALUE_EXPR"[, "TABLE", ...])

Metadata of the table to look up. The meta() function returns tables that match attributes specified by the KEY_VALUE_EXPR option.

KEY_VALUE_EXPR
Comparison expression in the form of "KEY == VALUE" or "KEY != VALUE". You can use it with logical operators such as and or or, or with the not unary negation operator.
KEY
Key name of the table metadata
VALUE
Value of the table metadata (a wildcard pattern can be used)
[ "TABLE", "TABLE", ... ]
Table name of the table with names containing specific string patterns. If you don't specify the table, the command attempts to execute a metadata conditional expression on every table.

For ENT and STD, you can specify table metadata in TABLE > (Select a table) [General]. The metadata key for parser settings is logparser.

Optional Parameter

If you do not use duration, from or to, all logs are searched.

duration=INT{mon|w|d|h|m|s}
Time range to search the previous data based on the current time. You can specify the time in units of mon (month), w (week), d (day), h (hour), m (minute), and s (second). For example, 10s refers to "the last 10 seconds" based on the time the query is executed. This option cannot be used with from, to or window.
from=yyyyMMddHHmmss
Start date and time of the search period in the form of yyyyMMddHHmmss. The time period for the search includes the specified time point. If you provide only the first part, the command recognizes the remaining digits as 0. For example, if you provide 20130605, the command recognizes it as 20130605000000 (June 5, 2013, 00:00:00). This option can be used with to, but cannot be used with duration and window.
to=yyyyMMddHHmmss
End date and time of the search period in the form of yyyyMMddHHmmss. The time period for the search does not include the specified time point. The input format is the same as from. This option can be used with from, but cannot be used with duration and window.
window=INT{y|mon|w|d|h|m|s}
Period of time for which to receive data in real time from the time the query is executed. You can specify the time in units of y (year), mon (month), w (week), d (day), h (hour), m (minute), and s (second). When the unit is y, only 1y is allowed. For example, 10s refers to "the next 10 seconds" from the time the query was executed. This option cannot be used with duration, from or to.
limit=INT
Maximum number of records to load (default: unlimited).
offset=INT
Number of records to skip (default: 0).
order=STR
Sorting order of the records (default: desc).
  • asc: Sorts in ascending order, the oldest at the top.
  • desc: Sortes in descending order, the latest records at the top.

Usage

  1. Read the last 100 logs from the sys_cpu_logs table

    table limit=100 sys_cpu_logs
    
  2. Read logs for the last 10 minutes from the sys_cpu_logs table.

    table duration=10m sys_cpu_logs
    
  3. Read all logs corresponding to the date of June 5, 2013, from the sys_cpu_logs table.

    table from=20130605 to=20130606 sys_cpu_logs
    
  4. Read all logs from the sys_cpu_logs and sys_mem_logs tables in sequence.

    table sys_cpu_logs, sys_mem_logs
    
  5. Read data from tables which have parser metadata with the value of openssh.

    table meta("parser==openssh")