table

Retrieves data stored in a Logpresso table.

Command properties

Syntax

To query historical data:

To receive real-time data:

Options

order={desc|asc}

Table scan order (default: desc).

• desc: Retrieves from the most recent data
• asc: Retrieves from the oldest data

offset=LONG

Number of records to skip. Specify a value of 0 or greater.

limit=LONG

Maximum number of records to retrieve.

duration=INT{s|m|h|d|mon}

Limits the data to within a specified time range from the current time. Supports units s (seconds), m (minutes), h (hours), d (days), and mon (months). For example, 10m means the range from 10 minutes ago to the current time. Cannot be used together with window.

from=DATE

Start time of the query range. Enter in yyyyMMddHHmmss format. Trailing digits can be omitted and are filled with zeros. Cannot be used together with window.

to=DATE

End time of the query range. Enter in yyyyMMddHHmmss format. Trailing digits can be omitted and are filled with zeros. Cannot be used together with window.

window=INT{s|m|h|d|mon}

Receives data newly written to the table in real time for the specified duration after the query starts. Supports units s (seconds), m (minutes), h (hours), d (days), and mon (months). Cannot be used together with from, to, or duration.

parser=STR

Name of the log parser to use for record parsing.

parallel=BOOL

When set to t, enables parallel scanning. If limit is not specified, the scan order is automatically switched to ascending.

eachtable=BOOL

When set to t, applies offset and limit per table rather than to the total result set.

raw=BOOL

When set to t, retrieves raw data without applying a log parser. Requires administrator privileges.

Target

TABLE

Name of the table to query. Specify in the format [NODE:][[NAMESPACE\]]TABLE[?]. You can specify multiple tables separated by spaces, and you can use the * wildcard.

• NODE: — Data Node name. If omitted, the query targets the local node where it runs. To search all nodes, specify *:.
• NAMESPACE\ — Table namespace (optional)
• TABLE — Table name
• ? — Appended to the name; skips the table without error if it does not exist

You can also select targets by metadata condition instead of by table name.

Queries the tables whose metadata value for KEY matches VALUE. Combine conditions with and, or, and not, and negate with !=. A table pattern after the condition limits the check to the tables matching that pattern; if omitted, all tables (*) are checked. For example, table meta("logparser==iis") queries every table that uses the iis parser, and table meta("logparser==iis", "WEB_*") applies the same condition only to tables whose names start with WEB_. Values can use wildcards (*, ?).

Metadata is a set of key/value pairs attached to each table. Some keys are recorded by the product, and others are set by an administrator. The keys the product uses are as follows.

The key list is not fixed. Apps and administrators can set arbitrary keys, so check the keys and values available in your environment before using them in a condition. Case sensitivity for literal values without a wildcard differs by series. In the 4.0 series starting with 4.0.2609.0, values are matched case-sensitively. The 5.0 series (through 5.0.2605.2) does not distinguish case.

Output fields

If a log parser is configured for the table, the fields returned by the parser are also included.

Error codes

Parsing errors

Runtime errors

N/A

Description

The table command retrieves data stored in a Logpresso table. As a driver query, it must be used as the first command in a query pipeline.

When the window option is specified, the command operates in real-time reception mode instead of scanning historical data. It receives data newly written to the table until the specified time has elapsed from when the query started or until the query is cancelled. It cannot be used together with the from, to, or duration options.

In a distributed environment, the scan is executed on each Data Node where the table is stored.

Examples

1. Retrieve all data from a web server log

   table WEB_APACHE
   

   Retrieves all web access records from the WEB_APACHE table.

2. Retrieve firewall block events for a specific period

   table from=20250315 to=20250319 FW_BLOCK_LOG
   

   Retrieves events blocked by the firewall from March 15, 2025 to March 19, 2025.

3. Retrieve the top 100 recent security events in the last hour

   table duration=1h order=desc limit=100 SECURITY_EVENT_LOG
   

   Retrieves the 100 most recent security events from the last hour in reverse chronological order.

4. Retrieve multiple security logs at once

   table duration=1d WEB_APACHE FW_BLOCK_LOG NET_DNS_QUERY_LOG
   

   Retrieves web access logs, firewall block logs, and DNS query logs all from the last day.

5. Retrieve web server logs using a wildcard

   table duration=1d WEB_APACHE*
   

   Retrieves web server logs from the last day from all tables whose names start with WEB_APACHE.

6. Monitor real-time security events

   table window=60s SECURITY_EVENT_LOG
   

   Receives new security events written to the SECURITY_EVENT_LOG table in real time for 60 seconds from when the query starts.

7. Dynamic date range query using parameters

   set from = string(dateadd(now(), "day", -7), "yyyyMMdd")
   | set to = string(now(), "yyyyMMdd")
   | table from=$("from") to=$("to") WEB_APACHE
   

   Retrieves web access logs for the last 7 days. Uses the set command to dynamically calculate and pass the date range as parameters.

Change history