All Apps and Add-ons

Website Monitoring: Index order of tr's within table appears to be sorted on value?

kmatuszczak
Observer

Have a website with multiple tables that consistently get updated and endstate is to track/graph changes over time.

There are multiple tr's per table, that change at different rates throughout the day.  Due to the changing at different rates, it appears that my `match` values are sorted alpha-numerically(i.e. 621 before 91) and therefore the mvindex changes throughout the day .

There is no other "anchoring" information I can scrape from the website other than the cardinal position.
Most recent event from `<search> | table match`:

 

 

2020-06-28 132 713 41 9 0 0 0 5 33 0
2020-06-28 362 0 0 0 0 0
2020-06-28 621 926 0 8 0 0 0 0
2020-06-28 91 130 0 84 46 0
2020-06-28 93 1094 0 35 1059 0

 

 

 one previous

 

 

2020-06-28 101 143 0 95 48 0
2020-06-28 104 1252 0 39 1213 0
2020-06-28 150 813 47 9 0 0 0 5 35 0
2020-06-28 408 0 0 0 0 0
2020-06-28 710 1061 0 8 0 0 0 0

 

 

As you can see by the number of fields per line, the mv's change order alpha-numerically.

I assume this is a bug? @LukeMurphey 
However, I would love an immediate temp solution solved through queries

P.S. I've verified that table portion is not doing some sort of unexpected "sort"

Labels (3)
Tags (1)
0 Karma

LukeMurphey
Champion

4.5.10 has been released with a fix for this.

LukeMurphey
Champion

I have a fix for this. I running the final tests and will be releasing very soon.

0 Karma

LukeMurphey
Champion

I have confirmed this; this is indeed a bug.

I opened a report (https://lukemurphey.net/issues/2807?issue_count=39&issue_position=1&next_issue_id=2492) and am planning for a fix in version 4.5.10.

BTW: the search command seems to retain the ordering. You might be able to use this in the meantime.

For example, the following retains the ordering:

| webscrape selector="tr" url="https://www.w3schools.com/html/html_tables.asp" depth_limit=25 empty_matches=0 

 

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...