The 'streamstats | stats last(*)' construct is the concept I was missing.
I ended up with a search rather like this:
source=backup OR source=volume
| eval fs_path=path
| eval backup_path=ndmp_path
| eval path=coalesce(fs_path, backup_path)
| sort -path source
| streamstats current=f reset_on_change=t values(path) as allpaths by server
| eval idx=mvfind(allpaths, "^" + path)
| eval match_path=if(isnotnull(idx), mvindex(allpaths, idx), path)
| stats last(*) as * by server match_path
| table server path fs_path backup_path
I still have some details to work out, but its workable.
Thanks!
... View more
