Query String Grouping lets you integrate a large number of fields together.
Query String Grouping is specific to each profile, but works well in transformations as shown in this example:
Create the pairs you wish to bundle by adding a custom configuration file ( E:…\Dataset\Log Processing\SC Fields.cfg) and then adding the Transformation Type BuildNameValuePair as a parameter.
2 = BuildNameValuePair:
Comments = Comment: 0 items
Condition = AndCondition: 0 items
Delimiter = string:
Input Columns = vector: 1 items
0 = Column:
Column Name = string: e100
Field Name = string: x-cust100
...
(all the fields you wish to build)
Name = string: Custom Events
Output = string: x-event-list
Create a new file for extracting the condensed data into the fields you wish to use by adding a custom configuration file ( E:…\Dataset\Transformation\SC Fields Transformation.cfg) and then adding the Transformation Type ExtractNameValuePairs as a parameter.
2 = ExtractNameValuePairs:
Comments = Comment: 0 items
Condition = AndCondition: 0 items
Delimiter = string:
Input Field = string: x-event-list
Name = string: Custom Events
Output Columns = vector: 1 items
0 = Column:
Column Name = string: e100
Field Name = string: x-cust100
...
(all the fields you wish to extract)
Name = string: Custom Events
Output = string: x-event-list
If you have many fields with custom evars, props, and variables, during log processing you can build a name value pair to combine fields in a report. For example, you can build named-value pairs into combined fields to reduce the tempDB file size.