Hi
I use two requests that are almost the same.
First request :
eventtype=Flag OR eventtype=Model
| rex "Model=(?<model>.*)"
| stats values(model) as Model by host
| stats dc(host) as host by Model
| sort -model limit=5
This request doesn't return values because the eventtype=flag,which corresponds to index="windows-fr" sourcetype="tools:flags" filename="TOTO*" is not respected
Second request
eventtype=Flag OR eventtype=NATCO
| eval NATCO=if(key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null)
| stats values(NATCO) as NATCO by host
| stats dc(host) as host by NATCO | sort -NATCO limit=5
I have a value for these request even if I also use the eventtype=Flag
Normally it should be also empty
what is the problem please?
Try this instead for your first search (which has several mistakes):
index=* AND (eventtype=Flag OR eventtype=Model)
| rex "Model=(?<model>.*)"
| eval model=coalesce(model, "WAS_NULL")
| stats dc(host) AS host by Model
| sort 5 -Model
eventtype=Flag OR eventtype=NATCO
If eventtype=NATCO returns events, it should be normal that you have some results, shouldn't it ?
NO
eventtype returns also results but
the stats(values) is used for doing a match between the two eventtype
So if eventtype= Flag is KO i have to have no results in others eventtype
In the second query if you use only "eventtype=NATCO" (instead of "eventtype=Flag OR eventtype=NATCO") do you have the same result?
Yes I have the same result
in fact I want to have a result if the condition mentionned in eventtype=Flag
(index="windows-fr" sourcetype="tools:flags" filename="TOTO*)" is OK
If the condition is KO I dont want results