Hello Experts, I have attached two images. The following search returns results as shown in "CURRENT" image. But i would like to have results as per "DESIRED" image. Could you please help. base search from JSON.. | stats values(date1) by hostname | rename values(date1) AS date1 | stats list(hostname) AS hostname by date1 | xyseries hostname date1 date1 Thank you. ... View more

I would like to fetch the latest record (only the first row) from two source types and check if both the fields are zeros or not. It's a success if both have zeros, else it's a failure if either of them is 1. The following query is near to the requirement, but the Status_r field never shows up to compare as it has the older time stamp. index="join_test1" sourcetype="Monitor_join_test" OR sourcetype="Response_join_test" | eval running_ok = if(Status="0" AND Status_r="0","0","1") |head 1 |eval final = if(running_ok==0,0,1) |table running_ok Status Status_r final ... View more

index="Index1" sourcetype="response" | eval running_ok = if(response_status="Running","0","1") |head 1 |join running_ok [search index="Index1" sourcetype="monitor" | eval running_ok = if(monitor_status="Running","0","1")|head 1] |eval final = if(running_ok==0,0,1) |eval final = if(running_ok==" " OR running_ok==1,1,0) |table final | outputlookup output.csv I am using join on two sourcetypes for the field "running_ok". The following table is derived based on how the inner join functions. Main search "running_ok" result), (Sub search "running_ok" result)= 0 or 1 or Blank (Join Search returned no values.) 0,0=0 (Running) 1,0= blank (Not Running) 0,1= blank (Not Running) 1,1=1 (Not Running) From these below, I am able to assign required value for "final" when running_ok=0 or 1, but I could not assign value for "final" when "Join search returns no values." Please let me know the way when join search returns no rows. |eval final = if(running_ok==0,0,1) |eval final = if(running_ok=="Join search returns no values." OR running_ok==1,1,0) The following two did not help either. | eval final=if(match(running_ok, "No results") OR running_ok=1, 1, 0) | | eval final = if(isnull(running_ok) OR running_ok==1,1,0) ... View more

|eval final = if(running_ok==" " OR running_ok==1,1,0) I want to assign final=1 when (running_ok=="No results found." OR running_ok==1). Running_ok==1 works fine, but it does not work when running_ok=="No results found." Please let me know what needs to be used on the RHS when search returns no values. ... View more

I want to display the result in a graph based on the results of the following two join searches. I can store these values in two lookup tables temporarily. Is there a way to read values from more than one lookup table at the same time? OR any other option in this situation? I may have to add more searches like these in future. index="index1" sourcetype="production-response" | eval running_ok = if(response_status="Reponse test success","2","0") |sort 0 - _time| join running_ok [search index="index1" sourcetype="production-monitor" | eval running_ok = if(monitor_status="Monitor running","2","0")|sort 0 - _time ] | stats count(eval(running_ok="0")) AS result | eval redCount = if(result >2,result,0)| eval greenCount = if(result <=2, result, 0) index="index2" sourcetype="sql-production-response"| eval running_ok = if(sql_monitor="sql process running","2","0") |sort 0 - _time| join running_ok [search index="index2" sourcetype="sql-production-monitor" | eval running_ok = if(sql_response="sql process running","2","0") |sort 0 - _time ] | stats count(eval(running_ok="0")) AS result | eval redCount = if(result >2,result,0)| eval greenCount = if(result <=2, result, 0) ... View more

Could you please explain the following three options of join? I could not understand them. usetime Syntax: usetime=<bool> Description: A Boolean value that Indicates whether to use time to limit the matches in the subsearch results. Used with the earlier option to limit the subsearch results to matches that are earlier or later than the main search results. Default: true earlier Syntax: earlier=<bool> Description: If usetime=true and earlier=true, the main search results are matched only against earlier results from the subsearch. If earlier=false, the main search results are matched only against later results from the subsearch. Results that occur at the same time (second) are not eliminated by either value. Default: true overwrite Syntax: overwrite=<bool> Description: Indicates whether fields from the subresults overwrite the fields from the main results, if the fields have the same field name. Default: true ... View more