Oracle Cloud Infrastructure Documentation

link

Use link command to group log records into high level business transactions. This command returns the link by fields along with the following details:

Topics:

Note

These are some of the limits associated with the link command:

  • The maximum number of groups returned by the query search or query export using console, CLI, or SDK is 500 when the query contains a link command.

    However up to 1 million groups can be processed in a link query execution and the data can be clustered and visualized using classify command

  • Maximum number of fields that can be included in the link command is 4. If time is one of the fields, then the maximum limit is 5.

Syntax

link [<link_options>] <fieldName> [, <fieldName>), ...]

where link_options can be expanded as [includenulls = [true|false]] [includetrends = [true|false]] [span = <span>].

Parameters

The following table lists the parameters used in this command, along with their descriptions.

Parameter Description

includenulls

Indicates if the results should include log records where the link by fields are null. The default value is false.

includetrends

Indicates if the results should include trend data. The default value is true.

span

Sets the length of time to be used for the result histogram.

Syntax: <int><timescale>.

timescale syntax: <sec> | <min> | <hour> | <day> | <week> | <mon>

  • sec values: s | sec | secs | second | seconds
  • min values: m | min | mins | minute | minutes
  • min values: h | hr | hrs | hour | hours
  • min values: w | week | weeks
  • min values: mon | month | months

Fields Generated by link for Each Group

The link command produces one row per group. A group is the unique combination of the input keys. For example:

  • link 'Host Name (Server)' produces one row for each host name. In this case, a group is a unique host name.
  • link 'Host Name (Server)', 'User Name' produces one row for each unique combination of the host name and the user name. In this case, a group is a unique host name and user name combination.

The following fields are automatically produced for each group:

Field Description
Collection The name of the collection where data is persisted. Used with the linkdetails command
ID Group ID that is unique within the collection
Count Number of log records within a group. In this UI, you can click this field to view the log records. You can also use Shift-Click to select one or more rows in the UI to view all those log records or cluster the log records, by using the following options respectively:
  • Click Show, select Log Records
  • Click Show, select Clusters
Start Time Earliest timestamp of log records within a group
End Time Latest timestamp of log records within a group
Group Duration Time duration of log records within a group. This field is hidden by default in the UI. You can show this field clicking Options, and selecting Hide/Show Columns option.

In addition, the following fields are also produced for all the groups. They are also hidden by default in the UI, and can be shown by clicking Options, and selecting Hide/Show Columns:

Field Description
Query Start Time Start Time of the query as selected using the time selector. If you override the time by specifying an explicit time range in the query, then that is used.
Query End Time End Time of the query as selected using the time selector. If you override the time by specifying an explicit time range in the query, then that is used.
Trend Interval The interval specified in the span parameter to the link command. This is the interval used for timestats and other charts. If no span was specified, a default is used.
Trend Interval Unit The unit for the interval specified in the span parameter to the link command.

For examples of using this command in typical scenarios, see:

The following command groups all the fatal logs by transaction:

severity = fatal | link 'Transaction ID'

The following command groups all the fatal logs by transaction, and gets the average elapsed time of log records within each group:

severity = fatal | link 'Transaction ID' | stats avg('Elapsed Time (System)') as 'Average Elapsed Time'