Display field based on value of another field

[bleung93]

I am trying to display the field homePath1 and homePath2 in a new field, to compare based on the eval field error. If the value of the field error is "error!!!", then I want the homePath1 and homePath2 to be displayed to easily see what is wrong, otherwise leave null. How would I do this?

| btool indexes | search sos_server="indexer1" | extract | eval index=stanza| table index,homePath | rename homePath as homePath1 | join [|btool indexes | search sos_server="indexer2" | extract | eval index=stanza| table index,homePath | rename homePath as homePath2] | eval error=if(homePath1
== homePath2, "good", "error!!!") | table index error

[martin_mueller · Accepted solution]

How 'bout this?

| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1

Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.

[martin_mueller]

That eval creates a new field by appending the two fields together, with a ": " in between. You can create any combination of fields and strings you need.

[bleung93]

You said that the server and path are linked together while eval sos_server_homePath. So does that mean you cannot link other fields with a field already linked?

[bleung93]

This is what I needed. Thanks Martin for the help!

[martin_mueller]

You could do this:

| btool indexes | eval sos_server_homePath = sos_server . ": " . homePath | stats dc(homePath) as dc values(sos_server_homePath) by stanza | where dc > 1

Adding a by sos_server would kill the distinct count, so you need to make a combined field first that ensures the server and path are linked together.

[bleung93]

Do you think there is a way to tell where the dc values(homePath) comes from? Instead of just displaying the values(sos_server), it is separated by each distinct sos_server field?

Linking the distinct sos_server to the corresponding homePath's.

[bleung93]

This is to compare index paths on different indexers to see if they are configured properly according to guidelines.