All Apps and Add-ons

Website Monitoring: Index order of tr's within table appears to be sorted on value?

kmatuszczak
Observer

Have a website with multiple tables that consistently get updated and endstate is to track/graph changes over time.

There are multiple tr's per table, that change at different rates throughout the day.  Due to the changing at different rates, it appears that my `match` values are sorted alpha-numerically(i.e. 621 before 91) and therefore the mvindex changes throughout the day .

There is no other "anchoring" information I can scrape from the website other than the cardinal position.
Most recent event from `<search> | table match`:

 

 

2020-06-28 132 713 41 9 0 0 0 5 33 0
2020-06-28 362 0 0 0 0 0
2020-06-28 621 926 0 8 0 0 0 0
2020-06-28 91 130 0 84 46 0
2020-06-28 93 1094 0 35 1059 0

 

 

 one previous

 

 

2020-06-28 101 143 0 95 48 0
2020-06-28 104 1252 0 39 1213 0
2020-06-28 150 813 47 9 0 0 0 5 35 0
2020-06-28 408 0 0 0 0 0
2020-06-28 710 1061 0 8 0 0 0 0

 

 

As you can see by the number of fields per line, the mv's change order alpha-numerically.

I assume this is a bug? @LukeMurphey 
However, I would love an immediate temp solution solved through queries

P.S. I've verified that table portion is not doing some sort of unexpected "sort"

Labels (3)
Tags (1)
0 Karma

LukeMurphey
Champion

4.5.10 has been released with a fix for this.

LukeMurphey
Champion

I have a fix for this. I running the final tests and will be releasing very soon.

0 Karma

LukeMurphey
Champion

I have confirmed this; this is indeed a bug.

I opened a report (https://lukemurphey.net/issues/2807?issue_count=39&issue_position=1&next_issue_id=2492) and am planning for a fix in version 4.5.10.

BTW: the search command seems to retain the ordering. You might be able to use this in the meantime.

For example, the following retains the ordering:

| webscrape selector="tr" url="https://www.w3schools.com/html/html_tables.asp" depth_limit=25 empty_matches=0 

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...