Hello there, I would like some help with my query. I want to summarize 2 fields into 2 new columns One field is unique, but the other is not The field fhost is not unique. I want the sum of field "cores" by unique combination of the columns    "clname" and  "fhost" I am struggle how to do this properly and how i can use the sum unique for column "fhost" | makeresults | eval clname="clusterx", fhost="f-hosta", vhost="v-hosta",cores=2,cpu=1 | append [| makeresults | eval clname="clusterx", fhost="f-hosta", vhost="v-hostb" ,cores=2,cpu=1 ] | append [| makeresults | eval clname="clusterx", fhost="f-hostb", vhost="v-hostc" ,cores=4,cpu=1 ] | append [| makeresults | eval clname="clusterx", fhost="f-hostc", vhost="v-hostd" ,cores=6,cpu=1 ] | eventstats sum(cpu) as total_vhost_cpus by clname ``` This is not working ``` | eventstats sum(cores) as total_fhost_cores by clname fhost `` The output should be in table format ``` | table clname cores cpu fhost vhost  total_vhost_cpus  total_fhost_cores Thank you in advance. Harry ... View more

Hi, I am trying to combine data from 2 indexen, but i find it hard to do. I tried several stats values command, but that  did not gave me the solution This is my source: collection        hostname        stage          stagedata                                                         st1               A1234;DEF                                                         st1               A3456;XYZ                                                         st2                A7890;XYZ                                                         st3                B1234;ABC COLLA               h1                     st1 COLLA              h2                     st1 COLLB              h3                      st2 COLLB              h4                      st2 COLLC             h5                       st1 COLLD              h6                       st3 An this is what i am trying to accomplice: collection hostname            stage     stagedata COLLA       h1                           st1          A1234;DEF                                                                       A3456;XYZ COLLA       h2                           st1          A1234;DEF                                                                       A3456;XYZ COLLB      h3                           st2           A7890;XYZ COLLB     h4                            st2           A7890;XYZ COLLC    h5                             st1           A1234;DEF                                                                        A3456;XYZ COLLD     h6                           st3            B1234;ABC Any help would be appreciated. Regards, Harry ... View more

Hello, I have a directory structure which i want split up in separate events. For example \MAIN\SUB1\SUB2\SUB3\file.xlsx This should be created as \MAIN \MAIN\SUB1 \MAIN\SUB1\SUB2\ \MAIN\SUB1\SUB2\SUB3\ Of course the number of subdirectories can vary, from 1 to many. I know i cannot use a for loop command, so i am searching for a way to handle my challenge. How should hanlde this, and is this possible? Any help is apprecated. Regards, Harry ... View more

Hello, I have a dashboard with 3 panels that load at the same time. Almost 3 identical searches. The difference is i add extra search criteria to the 2nd and 3th search. I would to refer in the  2nd and 3th panel to my base search, and add a token with the extra search criteria. This way i reduce my code. But i just cannot understand how to do this. <row>   <panel>     <table>       <title>Title1</title>         <search id="mainsearch">           <query>index=my_index                     ..........           </query>     </table>   </panel>   <panel>     <table>       <title>Title2</title>         <search id="secondsearch">           <query>index=my_index AND "local"                         ..same statements...           </query>         </table>   </panel> <panel>   <table>     <title>Title3</title>       <search id="thirdsearch">         <query>index=my_index AND (NOT "local")                         ..same statements...         </query>     </table>   </panel> </row> Any help is appreciated. Regards, Harry   ... View more

I would kindly need some help for a query i am not able to create. I have  inputlookups as source. And i want to filter with rows from another inputlookup Simplified: | inputlookup errmess_dev.csv | append [| inputlookup errmess_prod.csv] | table env,msg DEV          we are running out of cola too much sugar PROD      we are running out of wine better take juice PROD      we are running out of beer not so good I have another inputlookup which should be used as a filter. | inputlookup filterlines | table filter   running out of wine   out of cola I want to establish this: build the search filter from the inputlookup. How can i do this? Or is there perhaps a better way? | inputlookup errmess_dev.csv | append [| inputlookup errmess_prod.csv] | table env,msg | search NOT (errmsg="*out of beer*" OR errmsg="*out of wine*") | table, errmsg Any help is appreciated. Regards Harry ... View more

Hi, I am a newbie to SPL and would like some help. I want to find the latest date field in my lookup file file. My test.csv file look like this name,size,datum AA,11,12-09-2020 AA,18,14-09-2020 AB,33,15-04-2020 AB,34,16-04-2020 AB,35,15-06-2020 AC,23,14-05-2020 AC,14,08-07-2020 If i want to find the maximum value of column "size"  i succeed   |inputlookup test.csv | eval foo=[ |inputlookup test.csv |stats max(size) as dtx | return $dtx ] | table foo Result: 35 35 .. But when i try this with the date value i get this |inputlookup tabs.csv | eval foo=[ |inputlookup tabs.csv |stats max(datum) as dtx | return $dtx ] | table foo i get -2008 -2008 .. How to i match the latest date value ? Thank you in advance. Reagrds, Harry ... View more