topic Re: fetch host in Dashboards & Visualizations

fetch host

Jasmine — Fri, 12 Apr 2024 18:45:38 GMT

what is the error in the below query which i am using to populate in drop down list

index=aaa(source="/var/log/testd.log") |stats count by host | eval env=case(match(host, "*10qe*"), "Test", match(host, "*10qe*"), "QA", match(host, "*10qe*"), "Prod" )

Re: fetch host

marnall — Fri, 12 Apr 2024 19:14:30 GMT

Some potential problems with your query are:

1. index=aaa(source="/var/log/testd.log")
Does not have a space between the index and source filters

2. the match() functions in your eval env=case() part should have valid regexes in the second argument of the match function, as in match(<field>,<regex>). Try this:
| eval env=case(match(host, ".*10qe.*"), "Test",
match(host, ".*10qe.*"), "QA",
match(host, ".*10qe.*"), "Prod" )

ref: https://docs.splunk.com/Documentation/SCS/current/SearchReference/ConditionalFunctions

Re: fetch host

gcusello — Sat, 13 Apr 2024 05:22:02 GMT

Hi @Jasmine ,

as @marnall said a space is missing between the index value and the source condition.

I suppose that the erro is that the argument of the match function in the eval command is a regex, so you don't need to use asterisk:

index=aaa (source="/var/log/testd.log") | stats count by host | eval env=case( match(host, "10qe"), "Test", match(host, "10qe"), "QA", match(host, "10qe"), "Prod")

Ciao.

Giuseppe

Re: fetch host

Jasmine — Sat, 13 Apr 2024 11:50:02 GMT

host is same across all the env. i am facing issue when i bind the same value to drop down list saying "Duplicate values causing conflict". But i need dropdown list with TEST/QA/PROD(label) with same host value. - how can i achieve this?