Managing Columns

From the Review configuration page, you can update columns and data types for the associated data model.

You can also review column statistics for each defined parsing rule.

Procedure

  1. In the Columns panel all system and custom columns are displayed. You can add or remove columns by selecting the check box that is next to the column name. You can update any column name and type.
    • Name: The name of the column that is displayed in the results. To add or remove a column, click the check box next to the column name. To update the name of a user-defined column, click the column name.
      • The name can include letters, numbers, or underscore (_).
      • When used in an Advanced Search query or an expression, the name must be enclosed in square brackets ([ ]) in any of the following scenarios:
        Name Examples
        starts with a number [123]

        [12model]

        [1col_0]

        contains a hyphen [data-a]

        [-col1]

        [aBc-]

        contains all numbers [1234]
        contains a space [abc model]
      • A column name cannot include a period (.).
      • Two columns cannot have the same name.
      • You cannot use reserved keywords as the column name. For a list of reserved keywords, see Reserved Keywords.
    • Type: The data type of the column. Click in the column to add or update the supported data types. Select the data type from the list.
    • Parser rules: The rule name that includes the defined column.
  2. Select the Show system columns check box to show all system columns.
    By default, some system columns are selected. If the check box is not selected, only the user defined columns and some default system columns are displayed. For a list of system columns, see Types of Columns.
  3. After modifying column list, click to refresh the Parser preview panel to view all extracted columns and their data types for the defined parsing rule. For custom columns, click in the Type field to change the supported data type. Select the data type from the list.
  4. Click Save to save the column updates.
    The Match statistics panel helps you view an overall information about events that are matched by specified parsing rule. It displays how many rules are enabled, how many columns are extracted by the rule, and how many events are matched with each rule.