Query Information Table Generated with includeinfo Option
Use the includeinfo = True option with the link command to include a query metadata table in the results.
Topics:
Query Information Table
The table named Query Information contains the following information about the query:
- Total Matched Count: Number of log records that matched the query before the
linkcommand. For exampleerror | link includeinfo = Truereturns the number of records that matched the keyworderror. - Total Group Count: Total number of groups returned by
link, before any filters are applied. This is the number of rows in the link table before anyWHEREor other filter commands are applied in thelinkquery. - Total Count: Total number of groups after the filters are applied. This is the final number of rows in the link table after all the
WHEREand other filter commands are applied. - Query Start Time: Start time of the query, as selected in a
Timefield in the query, or the time selector. - Query End Time: End time of the query.
- Trend Interval: A number indicating the value of the
spanparameter to thelinkcommand. If no span is given, or if the provided span cannot be supported, then a span is auto-computed. - Trend Interval Unit: The unit used for the span. For example
link span=1minwould set the value of this field toMINUTE.
Use Query Information in link Tiles
The fields available in the Query Information table can be used from Tiles in Link. Following is an example of using this information from a tile.
<summary>
<container display="none">
<table>
<row>
<column>
<tiles>
<tile type="inline">
<title>
<title-text>Summary</title-text>
</title>
<tile value="Found "/>
<tile field="Query Information[Total Matched Count]"/>
<tile value=" records matching the query."/>
</tile>
</tiles>
</column>
</row>
</table>
</container>
</summary>