I am trying to display the field homePath1 and homePath2 in a new field, to compare based on the eval field error. If the value of the field error is "error!!!", then I want the homePath1 and homePath2 to be displayed to easily see what is wrong, otherwise leave null. How would I do this?
| btool indexes | search sos_server="indexer1" | extract | eval index=stanza| table index,homePath | rename homePath as homePath1 | join [|btool indexes | search sos_server="indexer2" | extract | eval index=stanza| table index,homePath | rename homePath as homePath2] | eval error=if(homePath1
== homePath2, "good", "error!!!") | table index error
How 'bout this?
| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1
Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.
How 'bout this?
| btool indexes | stats dc(homePath) as dc values(homePath) values(sos_server) by stanza | where dc > 1
Can't test right now, but this should produce a table of stanzas where the distinct count of homePaths is greater than one, ie differing homePaths exist throughout your deployment. You should get a couple lists of values as well to help investigation.
That eval creates a new field by appending the two fields together, with a ": " in between. You can create any combination of fields and strings you need.
You said that the server and path are linked together while eval sos_server_homePath. So does that mean you cannot link other fields with a field already linked?
This is what I needed. Thanks Martin for the help!
You could do this:
| btool indexes | eval sos_server_homePath = sos_server . ": " . homePath | stats dc(homePath) as dc values(sos_server_homePath) by stanza | where dc > 1
Adding a by sos_server
would kill the distinct count, so you need to make a combined field first that ensures the server and path are linked together.
Do you think there is a way to tell where the dc values(homePath) comes from? Instead of just displaying the values(sos_server), it is separated by each distinct sos_server field?
Linking the distinct sos_server to the corresponding homePath's.
This is to compare index paths on different indexers to see if they are configured properly according to guidelines.