i have a list of hostnames being generated from left join for different application in multivalue table column APP1 hostname1 hostnames2 appdelta syzhost.domain1 abchost.domain1 egfhost.domain1 syzhost.domain1 abchost.domain1       what i need is a column with  just egfhostdomain1 in a separete column just showing the diff of the list ... View more

Hi i have a list of servers coming from two different sources list A has server without domain names and list B has servers with and without domain names i was trying to compare the two list and get matching and not matching value  problem is bot the list have same server but because of domain name it says not matching  i understand if function is probably not the correct choice and when i use case with like it give me error any suggestions on this   |makeresults | eval listA="xyz1apac" ,listB="xyz1apac.ent.bhpbilliton.net" | append [| makeresults | eval listA="xyz2" ,listB="xyz2.ent.bhpbilliton.net"] | append [| makeresults | eval listA="xyz3emea" ,listB="xyz3emea"] | append [| makeresults | eval listA="xyz4abc" ,listB="xyz4abc.ent.bhpbilliton.net"] | fields - _time | eval matching=if(listA != listB, "NOT OK", "OK")   thanks ... View more

i have a field coming after a calculation  like a percentage field the request from user is to display in text format | makeresults | eval value = 36 | eval display = "the total percentage is $value$ %" | fields - value how can i display the total percentage is 36 % ... View more

Hi  i have data from two columns and using a third column to display the matches | makeresults | eval GroupA = 353649273, GroupB=353648649 | append [ | makeresults | eval GroupA = 353649184, GroupB=353648566] | append [ | makeresults | eval GroupA = 353649091, GroupB=353616829] | append [ | makeresults | eval GroupA = 353649033, GroupB=353638941] | append [ | makeresults | eval GroupA = 353648797] | append [ | makeresults | eval GroupA = 353648680] | append [ | makeresults | eval GroupA = 353648745] | append [ | makeresults | eval GroupA = 353648730] | append [ | makeresults | eval GroupA = 353638941] | fields - _time | foreach GroupA [eval match=if(GroupA=GroupB,GroupA ,NULL)] | stats values(GroupA) values(GroupB) values(match)   however nothing is getting displayed in values(match). is there something wrong in the logic or alternate way to do it  ... View more

Hi i have a below query where I'm calculating the total prod server count in first dataset and in second dataset I'm plottting a timechart for the server count. what i want to display is a line chart with total prod server showing as threshold and line and the below line chart as server count index=data sourcetype="server" | rex field=_raw "server=\"(?<EVENT_CODE>[^\"]*)" | search [ | inputlookup prodata_eventcode.csv | fields EVENT_Code ] | stats dc(host_name) as server_prod_count |rename | append [ | search index=appdata source=appdata_value | rex field=value "\|(?<Item>[^\|]+)?\|(?<EVENT_CODE>[^\|]+)|(?<PROD_Count>[^\|]+)?" | dedup DATE,EVENT_CODE | timechart span=1d sum(PROD_Count) as SERVER_COUNT] | table _time,local_PROD_COUNT,snow_prod_count | rename DYNA_PROD_COUNT as SERVER_COUNT,snow_prod_count as Threshold Question is how can  i get the threshold value in all the rows so that i can plot threshold vs server count in the line graph  Below is the snapshot    ... View more

Hi All i have a csv look up with below data Event_Code AUB01 AUB36 BUA12 i want to match it with a dataset which has field name  Event_Code with several values i need to extract the count of the event code per day from the matching csv lookup  my query index=abc |rex field=data "\|(?<data>[^\.|]+)?\|(?<Event_Code>[^\|]+)?\|" | lookup dataeventcode.csv Event_Code | timechart span=1d dc(Event_Code) however the result is showing all 100 count per day instaed of matching the event code from the CSV and then give the total count per day ... View more