Hello I use the search below `wire`
| fields AP_NAME USERNAME LAST_SEEN
| eval USERNAME=upper(USERNAME)
| eval LAST_SEEN=strptime(LAST_SEEN, "%Y-%m-%d %H:%M:%S.%1N")
| lookup aps.csv NAME as AP...
See more...
Hello I use the search below `wire`
| fields AP_NAME USERNAME LAST_SEEN
| eval USERNAME=upper(USERNAME)
| eval LAST_SEEN=strptime(LAST_SEEN, "%Y-%m-%d %H:%M:%S.%1N")
| lookup aps.csv NAME as AP_NAME OUTPUT Building Country Site
| lookup fo_all HOSTNAME as USERNAME output SITE BUILDING_CODE
| eval Building=upper(Building)
| eval Site=upper(Site)
| eval SITE=upper(SITE)
| eval LAST_SEEN = strftime(LAST_SEEN, "%Y-%m-%d %H:%M")
| stats last(LAST_SEEN) as "Last check date", last(AP_NAME) as "Access point", last(Site) as "Geolocation site", last(Building) as "Geolocation building", last(SITE) as "SNOW site", last(BUILDING_CODE) as "SNOW building" by USERNAME
| where NOT ('Geolocation building' = 'SNOW building')
| rename USERNAME as Hostname
| sort -"Last check date" As you can see in the where clause, I just need to display the Geolocation building fields which are differents than the SNOW building But it works randomly because I have fields where Geolocation building = SNOW building and where Geolocation building fields are not equal to SNOW building fields I tried : | where NOT like ('Geolocation building','SNOW building')
| where NOT match ('Geolocation building','SNOW building') But it changes anything! Other problem I need to do a conditional formating on SNOW building field but no colors are displayed! <format type="color" field="SNOW building">
<colorPalette type="map">{"ZB12":#4FA484,"G39":#AF575A,"ZD30":#294E70,"A50":#53A051,"E74":#B6C75A,"ZH38":#F8BE34}</colorPalette>
</format> What is the global problem please?