Query Information Table Generated with includeinfo Option

Query Information Table

The table named Query Information contains the following information about the query:

• Total Matched Count: Number of log records that matched the query before the link command. For example error | link includeinfo = True returns the number of records that matched the keyword error.
• Total Group Count: Total number of groups returned by link, before any filters are applied. This is the number of rows in the link table before any WHERE or other filter commands are applied in the link query.
• Total Count: Total number of groups after the filters are applied. This is the final number of rows in the link table after all the WHERE and other filter commands are applied.
• Query Start Time: Start time of the query, as selected in a Time field in the query, or the time selector.
• Query End Time: End time of the query.
• Trend Interval: A number indicating the value of the span parameter to the link command. If no span is given, or if the provided span cannot be supported, then a span is auto-computed.
• Trend Interval Unit: The unit used for the span. For example link span=1min would set the value of this field to MINUTE.

Use Query Information in link Tiles

The fields available in the Query Information table can be used from Tiles in Link. Following is an example of using this information from a tile.

<summary>
  <container display="none">
    <table>
      <row>
        <column>
          <tiles>
            <tile type="inline">
              <title>
                <title-text>Summary</title-text>
              </title>
              <tile value="Found "/>
              <tile field="Query Information[Total Matched Count]"/>
              <tile value=" records matching the query."/>
            </tile>
          </tiles>
        </column>
      </row>
    </table>
  </container>
</summary>