I am trying to display the field homePath1 and homePath2 in a new field, to compare based on the eval field error. If the value of the field error is "error!!!", then I want the homePath1 and homePath2 to be displayed to easily see what is wrong, otherwise leave null. How would I do this?
| btool indexes | search sosserver="indexer1" | extract | eval index=stanza| table index,homePath | rename homePath as homePath1 | join [|btool indexes | search sosserver="indexer2" | extract | eval index=stanza| table index,homePath | rename homePath as homePath2] | eval error=if(homePath1
== homePath2, "good", "error!!!") | table index error
This is to compare index paths on different indexers to see if they are configured properly according to guidelines.
How 'bout this?
| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1
Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.
Do you think there is a way to tell where the dc values(homePath) comes from? Instead of just displaying the values(sosserver), it is separated by each distinct sosserver field?
Linking the distinct sos_server to the corresponding homePath's.
You could do this:
| btool indexes | eval sos_server_homePath = sos_server . ": " . homePath | stats dc(homePath) as dc values(sos_server_homePath) by stanza | where dc > 1
by sos_server would kill the distinct count, so you need to make a combined field first that ensures the server and path are linked together.
You said that the server and path are linked together while eval sosserverhomePath. So does that mean you cannot link other fields with a field already linked?
That eval creates a new field by appending the two fields together, with a ": " in between. You can create any combination of fields and strings you need.