We had problem this week with logs indexed with lower or upper case hostnames. We run this query in a scheduled macro :
It seems that our eval functions don't do the job.
Query attached.
Thanks.
Solved by adding after tstats :
| eval host = lower(host) | stats max(latest) as latest,min(earliest) as earliest by host source
Solved by adding after tstats :
| eval host = lower(host) | stats max(latest) as latest,min(earliest) as earliest by host source
The problem is with tstats which is case sensitive, I haven't problem with stats but it's very slow.
Assuming your lookup table has host names in lower case, but indexed data has various case, try this
| tstats latest(_time) as latest,earliest(_time) as earliest WHERE index = * by host source | eval host=lower(host) | search [| inputlookup liste_serv | eval host = host+"*" | eval source=split(logsSystem, "#") | mvexpand source | table host source] | eval host = lower(replace(host,".production.com","")) | eval timeNow=relative_time( now(), "-8h@h") | where latest<timeNow | eval last=strftime(latest, "%Y-%m-%d %T") | eval first=strftime(earliest, "%Y-%m-%d %T") | sort - last | stats list(source) as source list(last) as "lastApparition" list(latest) as latest list(count) as count by host
Thanks somesoni2 however we already tried it by adding | eval host=lower(host) before inputlookup 😞