hello
In the search below, I need to display anything if the Hostname is not found
Actually, I have the fields displayed even if the hostname doesnt exists (see attachment here https://www.cjoint.com/c/KCmgUBEZndg)
How to display anything if the hostname doesnt exists please??
`wire`
| fields AP_NAME USERNAME LAST_SEEN
| lookup ap.csv NAME as AP_NAME OUTPUT Building Country Site
| rename USERNAME as host
| eval time = strftime(_time, "%d-%m-%y %H:%M")
| stats latest(time) as "Last check date", last(AP_NAME) as "Access Point", last(Site) as "Geolocation site", last(Building) as "Geolocation building" by host
| rename host as Hostname
| search Hostname=X3020131
| transpose 0 column_name="Geolocation items" header_field=header
| rename "row 1" as "Geolocation results"
Hi @jip31,
You can set include_empty parameter of transpose command to false;
`wire`
| fields AP_NAME USERNAME LAST_SEEN
| lookup ap.csv NAME as AP_NAME OUTPUT Building Country Site
| rename USERNAME as host
| eval time = strftime(_time, "%d-%m-%y %H:%M")
| stats latest(time) as "Last check date", last(AP_NAME) as "Access Point", last(Site) as "Geolocation site", last(Building) as "Geolocation building" by host
| rename host as Hostname
| search Hostname=X3020131
| transpose 0 column_name="Geolocation items" header_field=header include_empty=false
| rename "row 1" as "Geolocation results"
Hi @jip31,
You can set include_empty parameter of transpose command to false;
`wire`
| fields AP_NAME USERNAME LAST_SEEN
| lookup ap.csv NAME as AP_NAME OUTPUT Building Country Site
| rename USERNAME as host
| eval time = strftime(_time, "%d-%m-%y %H:%M")
| stats latest(time) as "Last check date", last(AP_NAME) as "Access Point", last(Site) as "Geolocation site", last(Building) as "Geolocation building" by host
| rename host as Hostname
| search Hostname=X3020131
| transpose 0 column_name="Geolocation items" header_field=header include_empty=false
| rename "row 1" as "Geolocation results"