I have two seperate searches that I appended together, but I only need one field out of the second search. My problem is the resolts shown on the table are incomplete, some of the fields are "null", when they should be the same as the other rows. Below is my search and the results:
index=windows (SourceName="HP FIRMWARE AUTOMATION PRE-COMPARE" OR SourceName="DELL FIRMWARE AUTOMATION PRE-COMPARE" OR SourceName="HP FIRMWARE AUTOMATION POST-COMPARE" OR SourceName="DELL FIRMWARE AUTOMATION POST-COMPARE") | rex field=hostName "^\w+.(?.)" | rex field=Compliant "^(?.)current\sversion:\s+(?\S+[^a-zA-Z])\s[=|>]\srepository\sversion:\s(?\S+[^a-zA-Z])" | rex field=Message "below (?.)" | eval Compliance=case(Message like "%rebootRequired%", "Compliant") | eval Payload_Staging_Status=case(Compliance="Compliant","Success") | fields hostName, customer, facility, platform, domain, manufacturer, model, Compliance, "Message Code", "Message Description", Payload_Staging_Status, Component, current_version, repository_version | append [ search index=windows (SourceName="HP FIRMWARE AUTOMATION SPP UPDATE FAILURE LOG" OR SourceName="DELL FIRMWARE AUTOMATION UPDATE LOG") | rex field=Message "^(?[^\,]+)" | rex field=ComputerName "^\w+.(?.)" | eval Compliance="Non-Compliant" | eval Payload_Staging_Status="Failure"] | eval fqdn=coalesce(ComputerName,hostName) | search fqdn="XXXX.XXXX.XXXXX" | table _time, fqdn, customer, facility, platform, domain, manufacturer, model, Compliance, "Message Code", "Message Description", Payload_Staging_Status, Message, Component, current_version, repository_version | rename fqdn as "Server Hostname", customer as LOB, facility as Mesh, platform as OS, domain as Domain, manufacturer as Manufacturer, model as Model, Payload_Staging_Status as "Payload Staging Status", Message as "Failure Message", current_version as "Post-Patch Version", repository_version as "Baseline Version"
the blank fields should be the same as the fields below it
