Surprisingly it worked after I switched values(IPADDR ) at the end.
Before I was doing the following
source=*prod*
| dedup SRV AVER ZONE
| fields + SRV , IVER, AVER, ZONE
| stats values(ZONE) as ZONE, values(IPADDR) as IPADDR, values(host) as host by SRV AVER
| nomv ZONE
| eval ZONE=replace(ZONE,"\s",",")
| nomv IPADDR
| eval IPADDR =replace(IPADDR ,"\s",",")
| nomv host
| eval host=replace(host,"\s",",")
It worked after I switched place between host & IPADDR:
source=*prod*
| dedup SRV AVER ZONE
| fields + SRV , IVER, AVER, ZONE
| stats values(ZONE) as ZONE, values(host) as host, values(IPADDR) as IPADDR by SRV AVER
| nomv ZONE
| eval ZONE=replace(ZONE,"\s",",")
| nomv host
| eval host=replace(host,"\s",",")
| nomv IPADDR
| eval IPADDR =replace(IPADDR ,"\s",",")
I am not sure why did this happen? Can anyone explain me the difference, and why it might not have worked. BTW, when I tried the first command, it did not even show the host field at all in the final output.
... View more