Hi, I want to setup a search to alarm me if a field ever changes its nature. To play around, I chose the year field in one of our indexes. This field appears to be numeric. field k="date_year" c="20" nc="20" dc="1" exact="1" relevant="0" All 20 counts are numeric, hence it should be numeric. I would expect this simple search to have isNum=true and isStr=false for all fields: index=foo | eval isStr= if(isstr(date_year),"true","false") | eval isNum= if(isnum(date_year),"true","false") | table isNum,isStr, date_year But this is what I get: isNum isStr date_year true true 2014 true true 2014 true true 2014 I have done some research, and I can't find any posts about this behaviour. Can someone explain to me why this is happening? Many thanks! R ... View more

Hi everyone, I am trying to find a way count the lines inside a lookup table and pass it to the return command. For example: I am currently using: index=index_foo [|inputlookup lookup_table_name | return 479 $field1 ] This works fine, but its a maintenance nightmare as the table changes size often. I wrote the following to try to have the subsearch count the rows and return them all: index=index_foo [|inputlookup lookup_table_name | stats count | return count $field1 ] unfortunately, that returns count="479" Is there a way to accomplish what I am trying to do? Thanks! ... View more