...R d.hash="bbbbbbbbbb" OR d.hash="ccccccccccc" CURRENT SEARCH -- not giving the expected result. index=hashstore
[| makeresults
| rename a.hash{} as hash
| eval a.hash="a...
Hello experts, I am trying to create a custom macro, from that it will returns a result depends on the argument I pass to it, like this: | makeresults | eval param=1 | eval result=case(p...
Hello,
I need to spoof some data and am using |makeresults for 3 hosts and their port status of "UP" (and eventually "DOWN")
| makeresults
| eval _raw = "host1%UP%UP%UP%#host2%UP%UP%UP%#h...
I executed the following SPL with makeresults, but the results only give me the fields for _time and _raw... i don't get parsed fields. Can this be solved?
|makeresults count=100|eval _raw="P...
I am aiming to provide headers to my generated report. I have 3 hosts, host1 host2 and host3. My report is configured with -7d@d to -1d@d (past 7 days). I would like to makeresults for the f...
If in case there are no results then dummy data should be added and returned from the subsearch ortherwise the actual data should be retruned to eval condition?
i.e How to make use of makeresults...
Hello,
One of the dashboards has a makeresults query like below, with about 250 append statements.
| makeresults| eval active="true"| makemv delim="," active| eval code="1234"| makemv d...
For example I have this query:
index=en_amp_api
[ | makeresults
| eval time = relative_time(now(),"-h@w1")
| eval format = strftime(time, "%m/%d/%Y:%H:%M:%S")
| eval e...