Hi Guys,
There is a csv which gets updated every day once with details such as-
VMName Group CPU Memory Storage PowerState
I need to add column as "Any Changes" with value Yes or No.
So that if there is change in values for particular host it should show as yes in "Any Changes" column-
VMName Group CPU Memory Storage PowerState AnyChanges
Note:- This needs to be checked for month,, if there are any changes it should be highlighted in column "Any Changes"
Please let me know how this can be implemented,.
Hi @shugup2923,
I don't have your data, but see this approach using the distict_count option of stats command:
index=your_index
| stats
dc(CPU) AS dc_CPU
dc(Memory) AS dc_Memory
dc(Storage) AS dc_Storage
dc(PowerState) AS dc_PowerState
values(CPU) AS CPU
values(Memory) AS Memory
values(Storage) AS Storage
values(PowerState) AS PowerState
values(Group) AS Group
BY VMName
| eval AnyChanges=if(dc_CPU>1 OR dc_Memory>1 OR dc_Storage>1 OR dc_PowerState>1,"Yes","No")
| table VMName Group CPU Memory Storage PowerState AnyChanges
Ciao.
Giuseppe
index=your_csv
|table columnA columnB columnC ....
|eventstats dc(*) as anychange_*
|eval anychange=0
|foreach anychange_* [ eval anychange=anychange+<<FIELD>>]
|eval "Any Changes"=case(anychange>0,"yes",anychange=0,"no")
|fields - anychange*
Is your Csv indexed daily?
Yes every day once