Query String Grouping

Query String Grouping lets you integrate a large number of fields together.

Query String Grouping is specific to each profile, but works well in transformations as shown in this example:

  1. Create the pairs you wish to bundle by adding a custom configuration file ( E:…\Dataset\Log Processing\SC Fields.cfg) and then adding the Transformation Type BuildNameValuePair as a parameter.

    2 = BuildNameValuePair:
          Comments = Comment: 0 items
          Condition = AndCondition: 0 items
          Delimiter = string:
          Input Columns = vector: 1 items
            0 = Column:
              Column Name = string: e100
              Field Name = string: x-cust100
              ...
      (all the fields you wish to build)
              Name = string: Custom Events
              Output = string: x-event-list
    
  2. Create a new file for extracting the condensed data into the fields you wish to use by adding a custom configuration file ( E:…\Dataset\Transformation\SC Fields Transformation.cfg) and then adding the Transformation Type ExtractNameValuePairs as a parameter.

    2 = ExtractNameValuePairs:
          Comments = Comment: 0 items
          Condition = AndCondition: 0 items
          Delimiter = string:
          Input Field = string: x-event-list
          Name = string: Custom Events
          Output Columns = vector: 1 items
            0 = Column:
              Column Name = string: e100
              Field Name = string: x-cust100
              ...
      (all the fields you wish to extract)
              Name = string: Custom Events
              Output = string: x-event-list
    

Other Uses

If you have many fields with custom evars, props, and variables, during log processing you can build a name value pair to combine fields in a report. For example, you can build named-value pairs into combined fields to reduce the tempDB file size.

On this page