i have a field called "Status" which contains "fresh" or "stale" which is distinct via host I want to do a distinct count by status in one row the "fresh" count is 20 the "stale" count is 1 i tried doing stats count(eval(status="fresh")) AS fresh1 count(eval(status="stale")) AS stale1 by host it continues to give me "1" for the "fresh" count when it should be 20. The only way this works is if i do stats count(eval(freshness="Fresh")) AS fresh1 by status. The problem is that it splits it in two rows. I need the answers in one row. Please Help ... View more

I'm trying to use the mySQL connector app and create a lookup from another source. Basically mysql table contains hostnames and additional info External text file contains list of hostnames. I want to do a lookup to connect those hostnames to the mysql hostnames. The problem is that it only works when i am in the mysql Connector app, NOT from the default search app. How can i link these two? Or how can i setup a lookup between two sources? Thanks ... View more

i have a txt file that is seperated by semicolons ";" that i am sending via TCP. How do i set it up to where i can assign each seperation with a field? i tried doing it through the web manager but it wouldnt extract the fields. This wouldn't work: props.conf: [xxx_fields] DELIMS=";" FIELDS = "x1", "x2", "x3", "x4", "x5", "x6", "x7", "x8", "x9" Example would be: Header x1;x2;x3;x4;x5;x6;x7;x8;x9 Raw Fields x;x;x;x;x;x;x;x;x Basically i just want to be able to search by the header fields...please help ... View more

i have a state file that writes the same size data file every 5 minutes but the data inside is only sometimes different. An example would be "event A = true" , but on the next write it might be "event A = false" I dont want it to reindex everything and spike the usage limit. Is there a way for me to just index the change from true to false? Thanks ... View more