I have a dynamic table extracted from a search result. Example Table1 that I can get:
Error | Code | Computer |
Internet Connection | 100 | CompA |
Blue Screen | CompB | |
App Crash | 5 | CompC |
My desired result:
For each row in the Table1, I would like to join the columns and make multisearch as below.
index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1
I didn't use format in this case because it would end up like..
index=computer OR index=application ( (Internet Connection AND 100 AND CompA) OR (Blue SCreen AND CompB) OR (App Crash AND 5 AND CompC) )
and returns many result instead of only 3 results.
Is the desired result possible to achieve?
Hi @chiilii
You have to extract fields required Error, code and computer for _raw events first and apply | table command should show you the output required.
How is your original events looks like?
Hi @venkatasri
Thanks for looking at this. I am able to get the table but not able to break the table into this:
index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1 index=computer OR index=application (Blue Screen AND CompB) | tail 1 index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1
what you are trying to achieve? | tail=1 is not a valid command.
Sorry have updated the tail and my post too. Hope it is more understandable