- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Strcat and lookups
I have a query regarding the use of the strcat functionality. The following search is used to generate and alarm condition.
index="ft" ftp | stats count(eval(status="failed")) as fail_cnt count(eval(status="success")) as success_cnt by user | strcat "[OPS:FTP:CRITICAL]{NODE:MON1}SFTP Connectivity " user host " Please raise incident with userdescription" "userdetails ALARM_DESCRIPTION | eval CLEAR=case(success_cnt>0, "1")
It works fine except that the userdetails and userdescription within the strcat argument will not populate. Userdetails and userdescription are lookups from a file (using the user field) which are valid and will populate if defined in a table i.e
| table user success_cnt failed_cnt userdetails userdescription
Any help on this would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It looks to me like you have mismatched "
(quote) marks, but maybe that was just transcribed wrong. Use the eval
+
or .
operators instead of strcat:
... | eval ALARM_DESCRIPTION = "String1" + user + host + " xyz" | ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

That is as designed. stats
only outputs field specifically computed, and the split-by fields. You should either run the lookup again, or use first(fieldname) as fieldname
in stats.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem here seems to be that no fields are passed on after the stats command.
