I am trying to create an rule with 2 information "Expected Host Not Reporting" & "Network Device Interface Down"
I would expect common host name from both searches, however not getting common host name with below mentioned search
| `host_eventcount(30,2)` | search is_expected=true | stats count by host | appendcols [search source="udp:50001" facility=ETHPORT port_status=down |stats count by host] |
BR
......SS
The appendcols
command is joiner-agnostic; it does a blind row-to-row merge of the 2 datasets. This is clearly not what you are desiring; it appears that you are trying to do a merge of the 2 datasets based on a common key so try this:
index=AlwaysUseAnIndexSpecifierYouNaughtyUser sourcetype="IJustToldYouAlwaysUseSpecifiersWhenYouCan" source="udp:50001" facility=ETHPORT port_status=down
| appendpipe [| `host_eventcount(30,2)` | search is_expected=true ]
| stats count(eval(port_status=down)) AS PORT_DOWN_COUNT count(eval(is_expected=true))) AS SOME_OTHER_COUNT BY host
It would be clearer if you used count(eval(sourcetype="A"))
and count(eval(sourcetype="B"))
but I had to go with what I could see in your searches.
The appendcols
command is joiner-agnostic; it does a blind row-to-row merge of the 2 datasets. This is clearly not what you are desiring; it appears that you are trying to do a merge of the 2 datasets based on a common key so try this:
index=AlwaysUseAnIndexSpecifierYouNaughtyUser sourcetype="IJustToldYouAlwaysUseSpecifiersWhenYouCan" source="udp:50001" facility=ETHPORT port_status=down
| appendpipe [| `host_eventcount(30,2)` | search is_expected=true ]
| stats count(eval(port_status=down)) AS PORT_DOWN_COUNT count(eval(is_expected=true))) AS SOME_OTHER_COUNT BY host
It would be clearer if you used count(eval(sourcetype="A"))
and count(eval(sourcetype="B"))
but I had to go with what I could see in your searches.