Memory and CPU Dashboard Field Error

[richardphung]

I get an error on the Memory and CPU Dashboard--- "Field 'fields' does not exist in the data."

index=extnet | dedup host  | rex max_match=0 "(MSM-(?<slotMSM>\w+)\s+|MM-(?<slotMM>\w+)\s+|Slot-(?<slotNum>\w+)\s+|)Total(\sDRAM\s|\s+)\(KB\):\s+(?<totalDRAM>\d+)"   | rex max_match=0 "(MSM-\w+\s+|MM-\w+|Slot-\w+\s+|)System\s+\(KB\):\s+(?<sysDRAM>\d+)"   | rex max_match=0 "(MSM-\w+\s+|MM-\w+|Slot-\w+\s+|Slot-\w+\s+|)User\s+\(KB\):\s+(?<userDRAM>\d+)"   | rex max_match=0 "(MSM-\w+\s+|MM-\w+|Slot-\w+\s+|Slot-\w+\s+|)Free\s+\(KB\):\s+(?<freeDRAM>\d+)"  | eval memSlot=if(isnotnull(slotMSM),slotMSM,memSlot) | eval memSlot=if(isnotnull(slotNum),slotNum,memSlot) | eval memSlot=if(isnotnull(slotMM),slotMM,memSlot) | eval fields=mvzip(totalDRAM,freeDRAM) | eval fields=if(isnotnull(memSlot),mvzip(fields,memSlot),fields) | mvexpand fields | rex field=fields "(?<fieldTotal>\w+),(?<fieldFree>\d+)(,(?<fieldSlot>\d+)|)" | eval pctFree=round((fieldFree/fieldTotal)*100,2) | where pctFree<50 | eval fieldTotal=round(fieldTotal/1024,2) | eval fieldFree=round(fieldFree/1024,2) | eval eventTime=strftime(_time,"%Y-%m-%d %H:%M:%S") | table host,fieldSlot,fieldTotal,fieldFree,pctFree,eventTime | sort +pctFree | rename host as "IP Address" fieldSlot as "Slot" fieldTotal as "Total DRAM (MB)" fieldFree as "Free DRAM (MB)" pctFree as "Percent DRAM Free" eventTime as "Latest Update"

This looks like a syntax issue around:

mvexpand fields

[richardphung]

I think this has something to do with the multivalue field being null...

index=extnet | dedup host  
| rex max_match=0 "(MSM-(?<slotMSM>\w+)\s+|MM-(?<slotMM>\w+)\s+|Slot-(?<slotNum>\w+)\s+|)Total(\sDRAM\s|\s+)\(KB\):\s+(?<totalDRAM>\d+)"   
| rex max_match=0 "(MSM-\w+\s+|MM-\w+|Slot-\w+\s+|)System\s+\(KB\):\s+(?<sysDRAM>\d+)"   
| rex max_match=0 "(MSM-\w+\s+|MM-\w+|Slot-\w+\s+|Slot-\w+\s+|)User\s+\(KB\):\s+(?<userDRAM>\d+)"   
| rex max_match=0 "(MSM-\w+\s+|MM-\w+|Slot-\w+\s+|Slot-\w+\s+|)Free\s+\(KB\):\s+(?<freeDRAM>\d+)"  
| eval memSlot=if(isnotnull(slotMSM),slotMSM,memSlot) 
| eval memSlot=if(isnotnull(slotNum),slotNum,memSlot) 
| eval memSlot=if(isnotnull(slotMM),slotMM,memSlot) 
| eval attr=mvzip(totalDRAM,freeDRAM) 
| eval attr=if(isnotnull(memSlot),mvzip(attr,memSlot),attr)
| mvexpand attr 

In this context.... the search doesn't yield anything for slotMSM, slotNum, or memSlot.
Or at least, these weren't returned as extracted fields.
so when it tries to mvzip, it is basically stitching together null, null.

[kmaron]

If you rename fields to something else does it work? I can't help but think it doesn't like the field name being fields.