How to assign multivalued field to a variable?

[Mohsin123]

Hi,

I'm trying to assign the multivalue field ApixRes and RestRes to a new variable result . But , it isnt working as expected .
PFB my code :
Intention : if the user selects component as APIX from the drop down then the result is shown as count by service else it will show count as component :
Kindly help:

index=<> sourcetype=<> component="APIX"   logpoint=response-out status-code =4* OR status-code =5* 
| rename status-code as statuscode 
| stats count as ApixC by service,statuscode 
| appendcols 
    [| search index=<>  sourcetype<>  NOT component="APIX" logpoint=response-out status-code =4* OR status-code =5* 
    | rename status-code as statuscode 
    | stats count as CompRest by component,statuscode] 
| eval ApixCount=mvappend(ApixC,service) 
| eval RestCount=mvappend(CompRest,component) 
| mvcombine ApixCount 
| mvcombine RestCount 
| eval ApixRes=mvappend(ApixCount,statuscode) 
| eval RestRes=mvappend(RestCount,statuscode) 
| eval result=if($component$="APIX",ApixRes,RestRes)

[renjith_nair · Accepted solution]

Hi @shraddhamuduli,

Try this run anywhere example. If it works fine, you need to replace search and "sourcetype" to service. This should be easier compared to assign all fields to a variable.

<form>
  <label>Shraddha</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok_from_dropdown">
      <label>Sourcetype/Component</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_*|stats count by sourcetype|append [|stats count|eval sourcetype="APIX"]|fields - count|dedup sourcetype</query>
        <earliest>-5m@m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel depends="$I_am_always_a_hidden_panel$">
      <table>
        <search>
          <query>|stats count|eval my_choice="$tok_from_dropdown$"|eval s_or_c=if("$tok_from_dropdown$"=="APIX","sourcetype","component")|fields s_or_c</query>
          <done>
            <set token="service_or_component">$result.s_or_c$</set>
          </done>
        </search>
      </table>
    </panel>
    <panel>
      <title>Selection is $service_or_component$</title>
      <table>
        <search>
          <query>index=_*|stats count by $service_or_component$</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

[FrankVl]

Have you checked whether the first part of your search (the search | appendcols [ subsearch] part) even gives sensible results? I can hardly imagine that construct works?

Also I can't make much sense of what your are trying to achieve with those mvappend and mvcombine actions.

If you want to choose between counting by service instead of by component, why not simply add an input for just that and put a token in the by clause of the stats command?

[jplumsdaine22]

What part is not working? Do ApixRes and RestRes show the correct values? Assuimng they do..

if($component$="APIX")... will probably evaluate to false every time, if $component$ is not a quoted string. For example, if you are just passing the value APIX, then you will end up with: | eval result=if(APIX="APIX", ...) . Unless you have a field called APIX that also has the value "APIX", then it will evaluate false. Try quoting the token like so $component|s$ . That will make the eval statement | eval result=if("APIX"="APIX", ...) which will eval to true.