Retrieves the data stored in the table.
table [OPTIONS] meta("KEY_VALUE_EXPR"[, "TABLE", ... ])
List of tables, separated by a comma (
If you put a question mark (
?) after the table name, no error occurs even if the table does not exist. For example, the
table testquery fails if test table does not exist. But if you execute the query
table test?, the query returns an empty result without an error.
You can use a wildcard (
*) in the table name. For example, if you execute the query command
table sys_*, all tables starting with
sys_are retrieved. Tables that you do not have read permissions for are excluded from the search. After executing a query, you can see the table name in the _table field.
meta("KEY_VALUE_EXPR"[, "TABLE", ...])
Metadata of the table to look up. The
meta()function returns tables that match attributes specified by the KEY_VALUE_EXPR option.
- Comparison expression in the form of
"KEY == VALUE"or
"KEY != VALUE". You can use it with logical operators such as
or, or with the
notunary negation operator.
- Key name of the table metadata
- Value of the table metadata (a wildcard pattern can be used)
[ "TABLE", "TABLE", ... ]
- Table name of the table with names containing specific string patterns. If you don't specify the table, the command attempts to execute a metadata conditional expression on every table.
For ENT and STD, you can specify table metadata in TABLE > (Select a table) [General]. The metadata key for parser settings is
If you do not use
to, all logs are searched.
- Time range to search the previous data based on the current time. You can specify the time in units of
s(second). For example,
10srefers to "the last 10 seconds" based on the time the query is executed. This option cannot be used with
- Start date and time of the search period in the form of
yyyyMMddHHmmss. The time period for the search includes the specified time point. If you provide only the first part, the command recognizes the remaining digits as
0. For example, if you provide
20130605, the command recognizes it as
20130605000000(June 5, 2013, 00:00:00). This option can be used with
to, but cannot be used with
- End date and time of the search period in the form of
yyyyMMddHHmmss. The time period for the search does not include the specified time point. The input format is the same as
from. This option can be used with
from, but cannot be used with
- Period of time for which to receive data in real time from the time the query is executed. You can specify the time in units of
s(second). When the unit is
1yis allowed. For example, 10s refers to "the next 10 seconds" from the time the query was executed. This option cannot be used with
- Maximum number of records to load (default: unlimited).
- Number of records to skip (default:
- Sorting order of the records (default:
asc: Sorts in ascending order, the oldest at the top.
desc: Sortes in descending order, the latest records at the top.
Read the last 100 logs from the
table limit=100 sys_cpu_logs
Read logs for the last 10 minutes from the
table duration=10m sys_cpu_logs
Read all logs corresponding to the date of June 5, 2013, from the
table from=20130605 to=20130606 sys_cpu_logs
Read all logs from the
sys_mem_logstables in sequence.
table sys_cpu_logs, sys_mem_logs
Read data from tables which have
parsermetadata with the value of