Query Information Table Generated with includeinfo
Option
Use the includeinfo = True
option with the link
command to include a query metadata table in the results.
Topics:
Query Information Table
The table named Query Information contains the following information about the query:
- Total Matched Count: Number of log records that matched the query before the
link
command. For exampleerror | link includeinfo = True
returns the number of records that matched the keyworderror
. - Total Group Count: Total number of groups returned by
link
, before any filters are applied. This is the number of rows in the link table before anyWHERE
or other filter commands are applied in thelink
query. - Total Count: Total number of groups after the filters are applied. This is the final number of rows in the link table after all the
WHERE
and other filter commands are applied. - Query Start Time: Start time of the query, as selected in a
Time
field in the query, or the time selector. - Query End Time: End time of the query.
- Trend Interval: A number indicating the value of the
span
parameter to thelink
command. If no span is given, or if the provided span cannot be supported, then a span is auto-computed. - Trend Interval Unit: The unit used for the span. For example
link span=1min
would set the value of this field toMINUTE
.
Use Query Information in link
Tiles
The fields available in the Query Information table can be used from Tiles in Link. Following is an example of using this information from a tile.
<summary>
<container display="none">
<table>
<row>
<column>
<tiles>
<tile type="inline">
<title>
<title-text>Summary</title-text>
</title>
<tile value="Found "/>
<tile field="Query Information[Total Matched Count]"/>
<tile value=" records matching the query."/>
</tile>
</tiles>
</column>
</row>
</table>
</container>
</summary>