Types of Columns
There are two types of columns: system columns and parsed columns.
The system columns are available by default in all data models. System columns contain event metadata such as event body (sys_body), event time (sys_eventTime), or the device name that produced the event (sys_device).
Parsed columns are specific to data models. They are defined in the data model and their values are parsed from the body of the event.
The following list describes all system-generated columns.
| Name | Type | Description |
|---|---|---|
| sys_body | String | The text of the event |
| sys_collectIP | InetAddress | The IP from where the event originated. This supports both IPv4 and IPv6. |
| sys_collectTime | Long | The time when the event was ingested
Currently unused. |
| sys_collectorDomain | String | Name of the collector domain for this event |
| sys_collectorDomainId | long | ID of the collector domain for this event |
| sys_concentratorId | String | IP address in IPv4 format, of the LogLogic LMI appliance or group of appliances on which a distributed Advanced Search query is run. |
| sys_device | String | Name of the device for this event |
| sys_deviceType | String | Name of the device type for this event |
| sys_eventKey | String | A unique key that identifies the event in the LogLogic storage |
| sys_eventTime | Timestamp | The UTC time of the event in Epoch milliseconds.
For syslog data, sys_eventTime is the time the event was collected. For file log data, sys_eventTime is the original event time. |
| sys_filename | String | The file name for event collected from a file |
| sys_sourceSubType | String | Sub-classification of the source type
Currently unused. |
| sys_sourceType | Integer | ID of the device type |
Note: Some system columns are not returned by default in queries that retrieve all columns, such as a
SELECT * query, as they are not generally needed in regular queries or they are currently unused. To obtain their values, their name must be explicitly specified in the
SELECT or
COLUMNS statement. Those columns are:
- sys_collectTime
- sys_collectorDomainId
- sys_concentratorId
- sys_domain
- sys_eventKey
- sys_filename
- sys_sourceSubType
- sys_sourceType