Hey guys, Thanks for the quick help, still stuck for some reason. So I've tried $row.host$ and $result.host$ but they both result in just passing $xxx.host$ for some reason. Here's the config: ...
See more...
Hey guys, Thanks for the quick help, still stuck for some reason. So I've tried $row.host$ and $result.host$ but they both result in just passing $xxx.host$ for some reason. Here's the config: Here's the resulting search: Here's the table query: index="netscaler" host=* | rex field="servicegroupname" "\?(?<Name>[^\?]+)" | rex field="servicegroupname" "(?<ServiceGroup>[^\?]+)" | rename "state" AS LastStatus | eval Component = host."|".servicegroupname | search Name=* | eval c_time=strftime(Time,"%m/%d/%Y %H:%M:%S") | streamstats window=1 current=f global=f values(LastStatus) as Status by Component | where LastStatus!=Status | rename _time as "Date" | eval Date=strftime(Date, "%m/%d/%Y %H:%M:%S") | table Date, host, ServiceGroup, Name, Status, LastStatus And, here's a screenshot of the table if helpful. Thanks again for the help on this one, very much appreciated. Tom