Hi,
i have a query that returns two lines of results based on two hosts.
i then get a result from another query that only returns one line.
When i do the eval command i get a correct 'Match' for the first line but no entry for the second.
How do i apply the 'appendcol' result to both lines?
index =systems sourcetype = stream_stack PID=0x0055
| eval Packets=packets*208
| stats latest(Packets) AS Packets by host
| appendcols
[ search index=systems sourcetype=soms_file_size process=soms | stats latest(file_size) AS file_size latest(file_name) AS file_name by process ]
| eval match=if(Packets=file_size,"OK","Error")
| table process match Packets file_size file_name host
RESULT
process match file_size file_name host
soms OK 27666832 DR_270919_P_5068_719_750_750.out chietrp01
Error chietrp02
thanks,
That's the way appendcols
works. The results from search 2 are added to the results from search 1 on a one-to-one basis. If there are fewer results in search 2 then some results from search 1 will not have the added columns. Also, note that the order in which the results are returned from each search should be the same so the one-to-one pairing of results makes sense.
If you need the results from search 2 to be replicated to all results of search 1 then perhaps filldown
will do.
Thank you richgalloway this worked.
For those seeking solution, here is the code for filldown, nice and easy -
index =systems sourcetype = stream_stack PID=0x0055
| eval Packets=packets*208
| stats latest(Packets) AS Packets by host
| appendcols
[ search index=systems sourcetype=soms_file_size process=soms | stats latest(file_size) AS file_size latest(file_name) AS file_name by process ]
| filldown process, file_size, file_name
| eval match=if(Packets=file_size,"OK","Error")
| table process match Packets file_size file_name host
That's the way appendcols
works. The results from search 2 are added to the results from search 1 on a one-to-one basis. If there are fewer results in search 2 then some results from search 1 will not have the added columns. Also, note that the order in which the results are returned from each search should be the same so the one-to-one pairing of results makes sense.
If you need the results from search 2 to be replicated to all results of search 1 then perhaps filldown
will do.