If I do this search
index=log NOT "*INFO*" earliest=-40d@d latest=-39d@d
| cluster t=0.3 field=raw showcount=t labelonly=false delims=" "
| eval old_label=cluster_label
| eventstats sum(cluster_count) as total_events
| eval Freq_Baseline=cluster_count/total_events
| fields _time, raw, old_label, cluster_count, Freq_Baseline, total_events
| collect index=clusters
Everything gets collected in index=clusters
BUT if I include this in a map,
index=is_log | head 1
| streamstats count as latest
| eval latest = 40
| eval earliest=latest + 1
| eval earliest= tostring(-earliest) + "d@d"
| eval latest= tostring(-latest) + "d@d"
| map maxsearches=35 search="search index=is_log NOT "*INFO*" earliest=$earliest$ latest=$latest$
| cluster t=0.3 field=raw showcount=t labelonly=false delims=" "
| eval old_label=cluster_label
| eventstats sum(cluster_count) as total_events
| eval Freq_Baseline=cluster_count/total_events
| fields _time, raw, old_label, cluster_count, Freq_Baseline, total_events
| collect index=clusters"
Then nothing is collected in the index, although the same results show up on the screen
The quotes in delims=" " may need to be escaped.
Thank you 🙂
The above command was really helpful so what if want to move source of data to other index without changing values to stash.