Hi @gcusello , The SPL is actually a report, so the data has not even been sent to the function t has been invoked. I tried to add just the one line to the report and noticed that the report ju...
See more...
Hi @gcusello , The SPL is actually a report, so the data has not even been sent to the function t has been invoked. I tried to add just the one line to the report and noticed that the report just disappears. I am also attaching the code below | mstats sum("mx.process.logs") as count WHERE "index"="mx_metrics" mx.env=$mx.env$ log.type=log span=10s BY pid service.name replica.name service.type module.names severity host cmd mx.env\
| rename module.names as Module
| rename host as Hostname
| rename severity as lvl
| rename pid as PID
| eval Module=if(Module!="",Module,"UNDEFINED")
| eval temp=split(Module,",")
| mvexpand temp
| eval recipient=("MX_MONITORING_".temp . "@mx.com")
| fields - temp
| rename _time as timestamp
| mvcombine delim="," recipient
| rename timestamp as _time
| fields _time count PID service.name replica.name service.type Module lvl Hostname cmd mx.env recipient
| sort 0 - _time
| stats values(service.name) as Services values(replica.name) as Replicas values(PID) as PIDs values(Hostname) as Hosts sum(count) as Count_Of_Errors earliest_time(replica.name) as Earliest_Error_Time latest_time(replica.name) as Latest_Error_Time values(lvl) as Severities values(recipient) as Owners by Module mx.env
| eval Earliest_Error_Time=strftime(Earliest_Error_Time,"%d/%m/%y %H:%M:%S")
| eval Latest_Error_Time=strftime(Latest_Error_Time,"%d/%m/%y %H:%M:%S")
| table Module Services Replicas PIDs Hosts Count_Of_Errors Earliest_Error_Time Latest_Error_Time Severities mx.env I tried using the line in an another report, and the other report also disapperas in the report filter. Now I feel that this is more of a bug that a code functionality issue. Please let me know what you feel about this? Regards, Pravin