I'm trying to create a table to view hosts in multiple indexes, and report if they are returning data.
For example
Host Index1 Index2 Index3
A OK OK
B OK OK
C OK OK
I've been using inputlookups to create a static list of hosts to reference, and appendcols to search indexes for the correct information. However, when used together the data isn't quite matching up like it does when I search separately. Any Suggestions?
About 95% of the time, appendcols is not the right solution to a Splunk problem. That's because the data doesn't always line up (as you've discovered).
Try this alternative
| tstats count where index=* host=* by host,index
| eval count=if(count==0, "", "OK")
| xyseries host index count
My search is something along the lines of this
|inputlookup serverlist.csv| table server| appendcols [search index=exampleIndex host IN(A B C)| eval statuscheck= if( host = server, "ok", "notok"| table statuscheck]
and then I would repeat the appendcols for another index
About 95% of the time, appendcols is not the right solution to a Splunk problem. That's because the data doesn't always line up (as you've discovered).
Try this alternative
| tstats count where index=* host=* by host,index
| eval count=if(count==0, "", "OK")
| xyseries host index count
This is what I was looking for! Thank you
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
Don't use appendcols?
Without seeing your searches, my guess would be that some of them are not returning results for all the hosts in the same order?