Dashboards & Visualizations
Highlighted

How to edit my appencols search?

Path Finder

I'm having issues with this panel when using appendcols. Here's the search:

index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*is_up_on_*" Status="crit" | stats dc(Filename) AS Database by Product | appendcols[search index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*buyer_integrated_realms_front_door.query" OR Filename="*s4_integrated_realms_front_door.query"  | eval Nstatus=if(Status== "info", 0, 1) | stats dc(Filename) AS iFrontdoors by Product] | appendcols [search index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer DataBlob="*uiHint: General*" Status="crit" | stats dc(Filename) AS Frontdoors by Product ] | table Product Frontdoors iFrontdoors Database

and here's the table that comes out:

alt text

The issue is that the "1" in iFrontdoors for "an" should be in the cell for "s4" and the an/ifrontdoor cell should be blank. Everything else lines up correctly. I've tried re-ordering the searches but that doesn't fix the issue. By process of elimination, when I take out the search for "iFrontdoors" the numbers line up correctly.

Anyone have any suggestions?

Thanks

0 Karma
Highlighted

Re: How to edit my appencols search?

Legend

If the issue is with the following query run the same in Verbose mode and validate the extracted Product field whether it is s4 or an. As per the stats I expect it to be an.

index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="buyerintegratedrealmsfrontdoor.query" OR Filename="s4integratedrealmsfrontdoor.query" | eval Nstatus=if(Status== "info", 0, 1) | stats dc(Filename) AS iFrontdoors by Product

PS: Seems like Nstats field is not used.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How to edit my appencols search?

Path Finder

Running that search in Verbose mode brings back the correct product and count

alt text

0 Karma