Absent Member.
Absent Member.
296 views

dedup Removes Field From Event List

Hi all,

I am using Logger Version 5.3.1.6838.0. Is anyone else observing that using  dedup <fieldName> in searches removes the contents of that field in the resulting event list?

For example, using  dedup sourceAddress  results in the sourceAddress field to be empty on all search results of that particular query.

The Addresses are still shown in the Field Summary and are evaluated correctly, just not shown any more in the results list.

It has nothing to do with the "keepevents" or "keepempty" parameters, I have checked those. It also has nothing to do with empty fields encountered during the evaluation, it is the same behaviour even when ensuring fields are NOT NULL.

Any further ideas?

Cheers

JP

Labels (1)
Tags (2)
0 Likes
2 Replies
Micro Focus Expert
Micro Focus Expert

Can you see if this is related to which field set you have chosen?


0 Likes
Absent Member.
Absent Member.

Hi Aaron,

indeed it seems to be related to a custom field set. When I use "all" or even "minimal" predefined field sets, the fields are still shown. Do you have any idea why this is happening and how to prevent it?

It gets even worse. When I have the dedup statement, I cannot use the deduped fields any more in custom field sets. Once I remove them from the currently selected field set (right column, where you can click on the left arrow to remove them), they disappear completely and are not shown in the corresponding field selection any more (e.g. no more "sourceAddress" under "source").

I cannot find any hint in the manual about this. It seems weird to say the least.

Cheers

JP

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.