Please explain the below query and why the source i.e. source="dfw1lvpap415" is mentioned in the join ?
index="auto_preprod_sa3_host" ":" AND ("architecture" OR "cpu*" OR "CPU(s)" OR "model*" OR "Model*") | rex field=_raw "(?.*)\:\s(?.*\d+|\w+|[a-z0-9#.)-])"
| rex field=source "/output/(?.*\w\d)\_" | join Parameter [search index="auto_preprod_sa3_host" ":" AND ("architecture" OR "cpu*" OR "CPU(s)" OR "model*" OR "Model*") source="*dfw1lvpap415*"
|rex field=_raw "(?.*)\:\s(?.*\d+|\w+|[a-z0-9#.)])"] | table Parameter, abc,def,Server_Name | eval Message=if(match(abc,def), "Same","Not Same")
| search Parameter=* AND NOT (Parameter="Model name" OR Parameter="model name " OR Parameter="model " OR Parameter="cpu MHz ") | stats values(abc) AS Realtime_Configurations values(def) AS Reference_Configurations values(Server_Name) AS Server by Parameter Message
| where Message="Not Same"
This is searching an index and doing 2 extractions, the first one is on raw data and the second one is extracting from source
. These have no field names
It's then joining on another search with the common field Parameter
and doing another extraction. Its than creating a table with the Parameter
field and I'm assuming the fields that were extracted out. It's then creating a new field called message
with conditional logic. If it matches then it will give message
a value of "same" else it gives it a value of "Not Same". It's then searching for all fields with a Parameter
field but excluding the values "Model Name", "model name", "model", and "cpu MHz". Lastly, its listing all its values in a table form and only searching where Message="not same"
No idea for source="dfw1lvpap415". You should do a quick tstats to see if that lives in your data
This is searching an index and doing 2 extractions, the first one is on raw data and the second one is extracting from source
. These have no field names
It's then joining on another search with the common field Parameter
and doing another extraction. Its than creating a table with the Parameter
field and I'm assuming the fields that were extracted out. It's then creating a new field called message
with conditional logic. If it matches then it will give message
a value of "same" else it gives it a value of "Not Same". It's then searching for all fields with a Parameter
field but excluding the values "Model Name", "model name", "model", and "cpu MHz". Lastly, its listing all its values in a table form and only searching where Message="not same"
No idea for source="dfw1lvpap415". You should do a quick tstats to see if that lives in your data
its easier to tell what are you looking to accomplish.
The above query is for CPU configuration comparison.