How do you get a description field with the output result fields?

[vrmandadi]

I have the below query

index=main AND sourcetype="abc" AND id=* AND ((state="terminated" AND image.attributes.name!="emr*") OR private_ip_address!=null) 
| eval time=strftime(_time,"%d/%m/%Y %H:%M:%S") 
| eval state = if(state=="terminated", state, null()) 
| eval node=aws_account_id 
| eval resource="Instance Termination" 
| eval type="Instance Terminated" 
| eval severity=1 
| stats values(private_ip_address) AS private_ip_address values(state) AS state BY id image.attributes.name 
| mvexpand private_ip_address 
| search state=terminated 
| search private_ip_address!=null

This gives the correct output with id image.attributes.name private_ip_address state. Now I want to have a description field that will change according to the results, but it's not populating because of the stats command running before this. How can we modify the search to result this output?

| eval description="The instance : ". image.attributes.name . " with id:" .id. " has status " .state . "with ip" .private_ip_address. " at ". time

Thanks

[woodcock]

No, no, no. Do not use + for concatenation because its primary function is addition and if any of your variables ever has a number in it, you will generate a NaN error. switch back to using . but make sure that you have spaces on each side of each period.

[vrmandadi]

I got it using + between each field worked

index=main AND sourcetype="aws:description" AND id=* AND ((state="terminated" AND image.attributes.name!="emr*") OR private_ip_address!=null) 
 | eval time=strftime(_time,"%d/%m/%Y %H:%M:%S")
| eval state = if(state=="terminated", state, null()) 
|stats latest(state) as state  , values(private_ip_address) as private_ip_address , latest(time) as time  by id image.attributes.name aws_account_id |rename image.attributes.name as name | mvexpand private_ip_address 
| search state=terminated 
| search private_ip_address!=null
| eval node=aws_account_id 
| eval resource="Instance Termination" 
| eval type="Instance Terminated" 
| eval severity=1
| eval description="The instance:" + name + " with id:" + id + " has status: " + state + " with ip: " + private_ip_address + " at time: " + time

[vnravikumar]

Hi @vrmandadi

Try like

your query.. | stats values(private_ip_address) AS private_ip_address values(state) AS state BY id image.attributes.name 
| eval temp= mvzip(private_ip_address, state) 
| mvexpand temp
| rex field=temp "(?<private_ip_address>[^\,]+)\,(?<state>[^\,]+)"
| eval description="The instance : ". image.attributes.name . " with id:" .id. " has status " .state . "with ip" .private_ip_address. " at ". time

[vrmandadi]

I tried this but it did not work

[lakshman239]

did you try to add your |eval description before stats?. Also you would need to add 'description' in your stats by clause

[vrmandadi]

Yes I did but no luck