I have a rex statement that parses multiple events and extracts the servers and its state:, something like below.
index="index-name" "keyword" instance="https://jenkins-*com" |rex field=_raw "}\s(?\d[-+]?[0-9]*.?[0-9]+)"| dedup 1 instance
the above query returns as below
Name state
instance1 1.00
instance2 0.00
instance3 1.00 .... so on
I add eval statements after this query to check if specific instance and state is matched.
this works, but the eval command gets repeated for all the occurrences of "instances"., like the following.
Name state eval_output
instance1 1.00 yes
instance2 0.00 no
instance3 1.00 yes
But, what i would like to achieve is to break the looping, meaning after eval command is executed for all instances, i add another eval statement which just uses the output and not adding it to all instances. how can i achieve this? I have this problem while using svg app.
... View more