My existing search string is:
index="os" OR index="app" host=ip-10-12-70-56.va2.b2c.nike.com sourcetype=ps| multikv fields ARGS filter java| rex "Db2cid\=(?<b2cid>job-\\w+..)_" | dedup b2cid,host | chart count by b2cid,host | eval b2cidlowr=lower(b2cid) | sort b2cidlowr | fields - b2cidlowr
This search is returning hosts
like the following:
job-AsyncReqAgentServer-0
job-CloseOrderAgentServer-0
job-CreateOrderJMSServer-0
job-CreateShipmentInvoiceJMSServer-0
job-FraudResponseJMSServer-0
But I have another couple of host which ideally should have reflected but not reflecting.
If I declare all the possible hosts in the search, can it return the hosts that are not getting rendered?
How to write such a search string?
Yes, you can declare them all in a list and attach this to your search like this:
| noop | stats count AS host | eval host="host1,host2,host3,host4,hostn" | eval b2cid="dummy" | makemv delim="," host | mvexpand host |append [index="os" OR index="app" host=ip-10-12-70-56.va2.b2c.nike.com sourcetype=ps| multikv fields ARGS filter java| rex "Db2cid\=(?<b2cid>job-\\w+..)_" | dedup b2cid,host] | chart count by b2cid,host | eval b2cidlowr=lower(b2cid) | sort b2cidlowr | fields - b2cidlowr
Yes, you can declare them all in a list and attach this to your search like this:
| noop | stats count AS host | eval host="host1,host2,host3,host4,hostn" | eval b2cid="dummy" | makemv delim="," host | mvexpand host |append [index="os" OR index="app" host=ip-10-12-70-56.va2.b2c.nike.com sourcetype=ps| multikv fields ARGS filter java| rex "Db2cid\=(?<b2cid>job-\\w+..)_" | dedup b2cid,host] | chart count by b2cid,host | eval b2cidlowr=lower(b2cid) | sort b2cidlowr | fields - b2cidlowr
Thanks a lot woodcock.
With some enhancement its fitting my requirements
Appreciate it!
@woodcock
was unable to find the proper explanation on noop command. Can you please guide me on this?
It is short for "NO OPeration". It is a command that does not require an input and does nothing put pass-through events. It is the most efficient way to create an empty event-set, which, when piped to stats count
gives us a single event that we can manipulate to create other events.