@tommoore - this is exactly what fixed my issue - thanks ... View more

Your string ":: ::: ::::" has white spaces which I suspect are causing you grief. Remove the white spaces between the various groups of ":" that you have in your string and then try something like this. | eval _raw = replace (_raw," +","=") This worked for me when I had to remove an unknown quantity of white spaces, but only when grouped at 4 or more white spaces. So for you a double eval may work best but might not be the most optimal solution if your regex skills are advanced enough. | eval _raw = replace (_raw,": :","::") | eval _raw = replace (_raw,"::+",":") ... View more

Well this isn't perfect to your case but could be a useful substitution, if you are will to accept the modifications in behavior. I have a very similar situation with multiple QoS across multiple Interfaces across multiple Hosts. Because some interfaces utilization is drastically different than another I want to watch per host, not per interface per host. Thus far any indication of no response appears to be reporting as a gap in my chart. My goal was to measure the interval change (new - old = delta), my only problem now is because of the forced values my first interval has an over inflated value that I need to drop. A sub search hasn't worked thus far, but this is a work in progress. The forced values were required as a result of any of the QoS values could be null and that would result in a null sum regardless if the other 8 QoS contained values. index=bulkstats (host=host-01 OR host=host-02) QoS8_dwlinkpkt_drop=* QoS8_uplinkpkt_drop=* | reverse | streamstats global=f current=f last(QoS1_dwlinkpkt_drop) as p_QoS1_dwlinkpkt_drop, last(QoS1_uplinkpkt_drop) as p_QoS1_uplinkpkt_drop, last(QoS2_dwlinkpkt_drop) as p_QoS2_dwlinkpkt_drop, last(QoS2_uplinkpkt_drop) as p_QoS2_uplinkpkt_drop, last(QoS3_dwlinkpkt_drop) as p_QoS3_dwlinkpkt_drop, last(QoS3_uplinkpkt_drop) as p_QoS3_uplinkpkt_drop, last(QoS4_dwlinkpkt_drop) as p_QoS4_dwlinkpkt_drop, last(QoS4_uplinkpkt_drop) as p_QoS4_uplinkpkt_drop, last(QoS5_dwlinkpkt_drop) as p_QoS5_dwlinkpkt_drop, last(QoS5_uplinkpkt_drop) as p_QoS5_uplinkpkt_drop, last(QoS6_dwlinkpkt_drop) as p_QoS6_dwlinkpkt_drop, last(QoS6_uplinkpkt_drop) as p_QoS6_uplinkpkt_drop, last(QoS7_dwlinkpkt_drop) as p_QoS7_dwlinkpkt_drop, last(QoS7_uplinkpkt_drop) as p_QoS7_uplinkpkt_drop, last(QoS8_dwlinkpkt_drop) as p_QoS8_dwlinkpkt_drop, last(QoS8_uplinkpkt_drop) as p_QoS8_uplinkpkt_drop, last(QoS9_dwlinkpkt_drop) as p_QoS9_dwlinkpkt_drop, last(QoS9_uplinkpkt_drop) as p_QoS9_uplinkpkt_drop by group, host | chart sum(eval((if(isnotnull(QoS1_dwlinkpkt_drop),QoS1_dwlinkpkt_drop,0) + if(isnotnull(QoS2_dwlinkpkt_drop),QoS2_dwlinkpkt_drop,0) + if(isnotnull(QoS3_dwlinkpkt_drop),QoS3_dwlinkpkt_drop,0) + if(isnotnull(QoS4_dwlinkpkt_drop),QoS4_dwlinkpkt_drop,0) + if(isnotnull(QoS5_dwlinkpkt_drop),QoS5_dwlinkpkt_drop,0) + if(isnotnull(QoS6_dwlinkpkt_drop),QoS6_dwlinkpkt_drop,0) + if(isnotnull(QoS7_dwlinkpkt_drop),QoS7_dwlinkpkt_drop,0) + if(isnotnull(QoS8_dwlinkpkt_drop),QoS8_dwlinkpkt_drop,0) + if(isnotnull(QoS9_dwlinkpkt_drop),QoS9_dwlinkpkt_drop,0)) - (if(isnotnull(p_QoS1_dwlinkpkt_drop),p_QoS1_dwlinkpkt_drop,0) + if(isnotnull(p_QoS2_dwlinkpkt_drop),p_QoS2_dwlinkpkt_drop,0) + if(isnotnull(p_QoS3_dwlinkpkt_drop),p_QoS3_dwlinkpkt_drop,0) + if(isnotnull(p_QoS4_dwlinkpkt_drop),p_QoS4_dwlinkpkt_drop,0) + if(isnotnull(p_QoS5_dwlinkpkt_drop),p_QoS5_dwlinkpkt_drop,0) + if(isnotnull(p_QoS6_dwlinkpkt_drop),p_QoS6_dwlinkpkt_drop,0) + if(isnotnull(p_QoS7_dwlinkpkt_drop),p_QoS7_dwlinkpkt_drop,0) + if(isnotnull(p_QoS8_dwlinkpkt_drop),p_QoS8_dwlinkpkt_drop,0) + if(isnotnull(p_QoS9_dwlinkpkt_drop),p_QoS9_dwlinkpkt_drop,0)))) as DW-Link, sum(eval((if(isnotnull(QoS1_uplinkpkt_drop),QoS1_uplinkpkt_drop,0) + if(isnotnull(QoS2_uplinkpkt_drop),QoS2_uplinkpkt_drop,0) + if(isnotnull(QoS3_uplinkpkt_drop),QoS3_uplinkpkt_drop,0) + if(isnotnull(QoS4_uplinkpkt_drop),QoS4_uplinkpkt_drop,0) + if(isnotnull(QoS5_uplinkpkt_drop),QoS5_uplinkpkt_drop,0) + if(isnotnull(QoS6_uplinkpkt_drop),QoS6_uplinkpkt_drop,0) + if(isnotnull(QoS7_uplinkpkt_drop),QoS7_uplinkpkt_drop,0) + if(isnotnull(QoS8_uplinkpkt_drop),QoS8_uplinkpkt_drop,0) + if(isnotnull(QoS9_uplinkpkt_drop),QoS9_uplinkpkt_drop,0)) - (if(isnotnull(p_QoS1_uplinkpkt_drop),p_QoS1_uplinkpkt_drop,0) + if(isnotnull(p_QoS2_uplinkpkt_drop),p_QoS2_uplinkpkt_drop,0) + if(isnotnull(p_QoS3_uplinkpkt_drop),p_QoS3_uplinkpkt_drop,0) + if(isnotnull(p_QoS4_uplinkpkt_drop),p_QoS4_uplinkpkt_drop,0) + if(isnotnull(p_QoS5_uplinkpkt_drop),p_QoS5_uplinkpkt_drop,0) + if(isnotnull(p_QoS6_uplinkpkt_drop),p_QoS6_uplinkpkt_drop,0) + if(isnotnull(p_QoS7_uplinkpkt_drop),p_QoS7_uplinkpkt_drop,0) + if(isnotnull(p_QoS8_uplinkpkt_drop),p_QoS8_uplinkpkt_drop,0) + if(isnotnull(p_QoS9_uplinkpkt_drop),p_QoS9_uplinkpkt_drop,0)))) as UP-Link by _time, host ... View more