I have a dashboard where I display a list of wines. I want to be able to incrementally add the wine name to a search criteria so the user can select the wines they are interested in. The wine name field is "Description", so I have the query like index=... $wines$ $wines$ is unset the first time around and this drilldown will work for the first click <set token="wines">$click.name2$=$click.value2|s$</set> which sets Description="wine", depending on the click, but of course this overwrites $wines$ each click. In order to build up the criteria I tried using eval/if I tried <eval token="wines">if(match($wines$, "Description"), "AlreadySet", "$click.name2$"="$click.value2|s$")</eval> but this results in $wines$ being 'false'. I know that if I just put "XX" in the else part of the if, it returns that. I have tried no quotes, double $ sign and so, but I can't make it work. I also tried elements with no luck. Any ideas on how I can achieve what I want, i.e. to ultimately get Description="Wine 1" OR Description="Wine 2" OR Description="Wine 3"... like a standard multi select dropdown. I'm not using that multi select as it's too slow - there are 10,000 wines... ... View more

I have a set of events that are racing results. One result/month for 10 months of the year. Points are awarded to runners for each race during the year. In order to find the annual winner, the monthly points are added and the winner is the person with the most points. Easy... index="bbr" sourcetype="bbr*" source="BBR*csv" Event=10km Year=2015 | stats sum(Points) as Total count as Runs count(eval(Place==1)) as Wins by Name, Gender | sort - Total However, the catch is that only the top 8 races for a runner count to the total, so if the runner runs 9 or 10 runs, then the lowest two points are not counted, so the sum(Points) above can't be used. I tried to do a sort by points for all runners and the idea was to then take only the first 8 records of each Name field, but I can't make this work. Any idea how to do this? ... View more

I think I am going mad... I set up a lookup table (points.csv) containing range,Place,Points 2013,1,20 2013,2,15 2013,3,11 2013,4,8 2013,5,6 2013,6,5 2013,7,4 2013,8,3 2013,9,2 2013,0,1 2004,1,5 2004,2,4 2004,3,3 2004,4,2 2004,0,1 1995,1,5 1995,2,4 1995,3,3 1995,4,2 1995,0,1 I created a lookup in transforms.conf [placepoints] filename = points.csv I created an automatic lookup [bbr*] LOOKUP-placepoints = placepoints Place range OUTPUTNEW Points AS PlacePoints This search index="bbr" sourcetype="bbr*" source="BBR*csv" host="Atacama" Event=10km Year=2016 Month=7 | rangemap field=Year 1995=0-2003 2004=2004-2012 2013=2013-9999 | table Name, Place, Points, PlacePoints | sort - Points I am pretty sure when I created this the first time it worked, however, I deleted the lookup and then have tried various incarnations of new attempts to get it to work again without luck and now I doubt I ever did get it to work, Putting the lookup in manually as in index="bbr" sourcetype="bbr*" source="BBR*csv" host="Atacama" Event=10km Year=2016 Month=7 | rangemap field=Year 1995=0-2003 2004=2004-2012 2013=2013-9999 | lookup placepoints Place range OUTPUTNEW Points as PlacePoints | table Name, Place, Points, PlacePoints | sort - Points works fine and I get PlacePoints (or any other name I use). So I started to wonder if it ever worked and the order or rangemap and automatic lookups. Is the range field available when the automatic lookup is run, i.e. does it run before the rangemap process or after it. ... View more

I have events with a type and an id. The id field can be null or a number where that number may repeat, e.g. type,id 1,NULL 1,NULL 1,NULL 3,1234 3.1234 1,2222 1.2222 1.2222 5,555 5,555 5,555 7,999 7,999 8,NULL I want to get a pie chart, which means I need a single column of results and I want to display 4 values type <= 3 (= class 0) type >3 (= class 1) | eval class=case(type <=3, 0, type > 3, 1) | stats count(eval(id=="NULL")) as Singles dc(id) as Multis by class | eval Class0Singles=case(class=0,Singles), Class1Singles=case(class=1,Singles), Class0Multis=case(class=0,Multis), Class1Multis=case(class=1,Multis) | fields - class Singles Multis | eval id = 1 | untable id Metric Value | fields - id The above gives me a table like this Class0Multis 2 (rows 4-8) Class0Singles 3 (first 3 rows) Class1Multis 2 (rows 9-13) Class1Singles 1 (row 14) which gets me the pie chart, but it seems rather cumbersome. I could do two counts without doing the "by class" to get the singles (id="NULL"), but the problem seems to be that it's not possible to dc(id) with a 'where class=1'. this is to produce a pie chart Is there a way to make this simpler? ... View more

I have data like: id,type,id2 1,a,100 2,a,100 3,c, 4,a,101 5,a,101 6,b,102 7,b,102 8,b,102 9,b,103 10,b,103 11,b,103 12,d,104 13,d,104 14,d,104 15,d,104 16,e, 17,c,105 18,c,105 What I am trying to do is to get the output: a=2 b=2 c=2 d=1 e=1 So, this is essentially a count of the number of 'type' where id2 are the same. In the above data, Count of (a=2) is id 1 and 2 are type 'a' and have id2=100 id 4 and 5 are type 'a' and have id2=101 Count of (b=2) is id 6,7 and 8 are type 'b' and have id2=102 id 9,10 and 11 are type 'b' and have id2=103 Count of (c=2) is id 3 is type 'c' and has no id2 id 17 and 18 are type 'c' and have id2=105 Count of (d=1) is id 12,13,14 and 15 are type 'd' and have id2=104 Count of (e=1) is id 16 is type 'e' and has no id2 and a final total of 8, which is 2+2+2+1+1 I can't figure out the search required. Note that all types may or may not have id2 and the duplication of id2 can be up to 20 instances of the same id2. ... View more

I have two types of log entry with a common field. I am using join to get the index=web_load sourcetype=instrument i_tx=func1 i_status=0 | join i_bid [ search index=web_load sourcetype=instrument i_tx=func2 ] ... The join is fine, but I am not sure what happens to fields that are in both rows with func1 and func2. I have a field i_elapsed which is the elapsed time for the function, but I am interested in min/avg/max stats about the i_elapsed field from the rows relating to func2. I can see a difference in my results if I reverse func1 and func2 round in the search, but am not sure what the rule is about common fields in the join. ... View more

I have an index with two 'transaction types'. Create and Offer. For each create, I get an ID and I want to find out all created Ids that do not get an offer. I am making multiple 'Offer' requests, so there can be more than one Offer row for each i_bid. I can do it with set diff using | set diff [ search index=web_load sourcetype=instrument i_tx=Create | stats count by i_bid | table i_bid ] [ search index=web_load sourcetype=instrument i_tx=Offer i_status=0 | stats count by i_bid | table i_bid ] | table i_bid and I get a table with the created ids from search (Create) that do not have an offer in search 2. However, I'd like to get this using stats if possible for efficiency as there will be hundreds of thousands of Create operations and set subsearches are limited to the default 10,000. I can create tables of i_bid and i_tx using index=web_load sourcetype=instrument i_status=0 i_tx=Create OR i_tx=Offer | stats count by i_tx, i_bid so, feel it ought to be possible to remove common i_bid ... View more