All Apps and Add-ons

Website Monitoring: Index order of tr's within table appears to be sorted on value?

kmatuszczak
Observer

Have a website with multiple tables that consistently get updated and endstate is to track/graph changes over time.

There are multiple tr's per table, that change at different rates throughout the day.  Due to the changing at different rates, it appears that my `match` values are sorted alpha-numerically(i.e. 621 before 91) and therefore the mvindex changes throughout the day .

There is no other "anchoring" information I can scrape from the website other than the cardinal position.
Most recent event from `<search> | table match`:

 

 

2020-06-28 132 713 41 9 0 0 0 5 33 0
2020-06-28 362 0 0 0 0 0
2020-06-28 621 926 0 8 0 0 0 0
2020-06-28 91 130 0 84 46 0
2020-06-28 93 1094 0 35 1059 0

 

 

 one previous

 

 

2020-06-28 101 143 0 95 48 0
2020-06-28 104 1252 0 39 1213 0
2020-06-28 150 813 47 9 0 0 0 5 35 0
2020-06-28 408 0 0 0 0 0
2020-06-28 710 1061 0 8 0 0 0 0

 

 

As you can see by the number of fields per line, the mv's change order alpha-numerically.

I assume this is a bug? @LukeMurphey 
However, I would love an immediate temp solution solved through queries

P.S. I've verified that table portion is not doing some sort of unexpected "sort"

Labels (3)
Tags (1)
0 Karma

LukeMurphey
Champion

4.5.10 has been released with a fix for this.

LukeMurphey
Champion

I have a fix for this. I running the final tests and will be releasing very soon.

0 Karma

LukeMurphey
Champion

I have confirmed this; this is indeed a bug.

I opened a report (https://lukemurphey.net/issues/2807?issue_count=39&issue_position=1&next_issue_id=2492) and am planning for a fix in version 4.5.10.

BTW: the search command seems to retain the ordering. You might be able to use this in the meantime.

For example, the following retains the ordering:

| webscrape selector="tr" url="https://www.w3schools.com/html/html_tables.asp" depth_limit=25 empty_matches=0 

 

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...