All Apps and Add-ons

Website Monitoring: Index order of tr's within table appears to be sorted on value?

kmatuszczak
Observer

Have a website with multiple tables that consistently get updated and endstate is to track/graph changes over time.

There are multiple tr's per table, that change at different rates throughout the day.  Due to the changing at different rates, it appears that my `match` values are sorted alpha-numerically(i.e. 621 before 91) and therefore the mvindex changes throughout the day .

There is no other "anchoring" information I can scrape from the website other than the cardinal position.
Most recent event from `<search> | table match`:

 

 

2020-06-28 132 713 41 9 0 0 0 5 33 0
2020-06-28 362 0 0 0 0 0
2020-06-28 621 926 0 8 0 0 0 0
2020-06-28 91 130 0 84 46 0
2020-06-28 93 1094 0 35 1059 0

 

 

 one previous

 

 

2020-06-28 101 143 0 95 48 0
2020-06-28 104 1252 0 39 1213 0
2020-06-28 150 813 47 9 0 0 0 5 35 0
2020-06-28 408 0 0 0 0 0
2020-06-28 710 1061 0 8 0 0 0 0

 

 

As you can see by the number of fields per line, the mv's change order alpha-numerically.

I assume this is a bug? @LukeMurphey 
However, I would love an immediate temp solution solved through queries

P.S. I've verified that table portion is not doing some sort of unexpected "sort"

Labels (3)
Tags (1)
0 Karma

LukeMurphey
Champion

4.5.10 has been released with a fix for this.

LukeMurphey
Champion

I have a fix for this. I running the final tests and will be releasing very soon.

0 Karma

LukeMurphey
Champion

I have confirmed this; this is indeed a bug.

I opened a report (https://lukemurphey.net/issues/2807?issue_count=39&issue_position=1&next_issue_id=2492) and am planning for a fix in version 4.5.10.

BTW: the search command seems to retain the ordering. You might be able to use this in the meantime.

For example, the following retains the ordering:

| webscrape selector="tr" url="https://www.w3schools.com/html/html_tables.asp" depth_limit=25 empty_matches=0 

 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...