I have a some fields like this:
**Group_servers|Name_server|Status**
Group1| server1|OK
Group1| server2|OK
Group2| server1|OK
Group2| server1|No data
Group2| server1|Yellow
Group2| server1|
I want to get the result as shown below
Group_servers|Status
Group1|OK
Group1| No data
Сonditions for the formation of status groups are as follows:
1. If at least one server in the group has the status "No data" or the field is empty, the status for the group is " No data"
2. If at least one server in the group has the "Yellow" status, the status for the group is " Yellow"
3. If all servers in the group have the status "OK", the status for the group is " OK"
@lex_orl
Can you please try this?
YOUR_SEARCH
| stats values(Status) as Status by Group_servers | eval Status=case(Status="" OR Status="No data","No data",Status="Yellow","Yellow",mvdedup(Status)="OK","OK")
My Sample Search:
| makeresults
| eval Group_servers="Group1,Group1,Group2,Group2,Group2,Group2",
Name_server="server1,server2,server1,server1,server1,server1",
Status="OK,OK,OK,No data,Yellow,",Group_servers=split(Group_servers,","),Name_server=split(Name_server,","),Status=split(Status,","),temp=mvzip(mvzip(Group_servers,Name_server),Status)
| fields temp
| mvexpand temp
| eval Group_servers=mvindex(split(temp,","),0),Name_server=mvindex(split(temp,","),1),Status=mvindex(split(temp,","),2)
| eval comment="Up to this is for data generation only"
| table Group_servers Name_server Status
| stats values(Status) as Status by Group_servers | eval Status=case(Status="" OR Status="No data","No data",Status="Yellow","Yellow",mvdedup(Status)="OK","OK")
Thanks
Map status names to codes and take the lowest code.
... | eval statusCode = case(Status="No data", 1, Status="Yellow", 2, Status="OK", 3, 1=1, 99) | streamstats window=0 min(statusCode) by Group_servers | table Group_servers Status
@lex_orl
Can you please try this?
YOUR_SEARCH
| stats values(Status) as Status by Group_servers | eval Status=case(Status="" OR Status="No data","No data",Status="Yellow","Yellow",mvdedup(Status)="OK","OK")
My Sample Search:
| makeresults
| eval Group_servers="Group1,Group1,Group2,Group2,Group2,Group2",
Name_server="server1,server2,server1,server1,server1,server1",
Status="OK,OK,OK,No data,Yellow,",Group_servers=split(Group_servers,","),Name_server=split(Name_server,","),Status=split(Status,","),temp=mvzip(mvzip(Group_servers,Name_server),Status)
| fields temp
| mvexpand temp
| eval Group_servers=mvindex(split(temp,","),0),Name_server=mvindex(split(temp,","),1),Status=mvindex(split(temp,","),2)
| eval comment="Up to this is for data generation only"
| table Group_servers Name_server Status
| stats values(Status) as Status by Group_servers | eval Status=case(Status="" OR Status="No data","No data",Status="Yellow","Yellow",mvdedup(Status)="OK","OK")
Thanks