Trying to use multiple searches to get a percentage of total servers to be restored and total currently restored but can not get all values to be shared.
I know it is the construct or the searches but can not figure out the issue, need some help to get the format right.
Here is the search that uses indexed data and lookup files:
|inputlookup DRServerList.csv
|search PhysicalVirtual=P (Platform!=IP* AND Platform!=link*)
|stats count as allPhys
|append [search index=main sourcetype=ssdr Result=good
| rex field=_raw "^(?:[^ \n]* ){6}(?\w+):\s+(?P.*)(?:[^ \n]* ){2}(?P\w+)\s+::\s+(?P\w+)(?:[^ \n]* ).*::\s(?P.+)"
|dedup Node
| eval HostName=lower(Node)
| join [inputlookup DRServerList.csv
|search PhysicalVirtual=P (Platform!=IP* AND Platform!=link*)
|eval HostName=lower(HostName)]
| stats count(eval(HostName==lower(HostName))) AS restore]
| eval mypercent=(restore/allPhys*100)
|table allPhys restore mypercent
↧