Referencing Resources

Available: Resource Referencing

From version 1.213, a reserved prefix is available for referencing resources.

Repository and View resources (saved searches, files) can be referenced using a macro, where the macro starts with $ and is used to identify a LogScale asset that is to be used as part of the query. For the macro, where the portion of the macro before the :// is used to identify the type of the resource. The prefix is case sensitive, and if no prefix is supplied then LogScale assumes the macro is a saved query.

  • Parser

    To reference a parser, use the prefix $parser://, for example, $parser://myParser(). To refer to a specific parser within a given package, use $parser://package/scope:myParser().

    Referencing the parser in this way only references the parser query language; not additional settings within the parser outside of the query content.

    Using the macro in this way enables inclusion of the parser processing within another parser.

  • Saved Search

    To reference a saved search, use the prefix $query://, for example, $query://myQuery().

For example, to reference a parser in another view:

logscale
$parser://paneview/custom-syslog

This references the locally defined parser custom-syslog within the paneview respository.

To reference resources in another package, the scope is tha vendor and package name. For example:

logscale
$parser://paneview/apache/http-access/apache_error

This references the >apache_error parser from the apache/http-access in the paneview view.

For more information on package scopes, see Understanding Package Scopes.

Tip

The Origin or Package column in resource views (for example Parsers Interface) will show the package name (and therefore scope) of a resource. A Local resource does not require the scope.

When using the macro:

  • Prefix is case sensitive.

  • If no prefix is supplied, then the reference is assumed to be a saved search.

  • If the resource type is not supported, then the reference is treated as an invalid reference, and an error will be produced noting that the resource cannot be resolved.

  • Circular references are not allowed.

  • Parameters can be added to saved searches and parser macros using the User Parameters/Variables notation.

During name resolution, the following options are available:

  • Resolve the resource within the local view or repository.