how get hostname from dt.source_entity and dt.entity.process_group_instance

[gasperetta]

HI, I need to pull out the hostname associated with each process:

this is my query...

timeseries count = sum(dt.log.status_per_entity_count, default: 0), by:{dt.source_entity,dt.entity.process_group,dt.entity.host}
| filter isNotNull(dt.source_entity)
| filter matchesValue(dt.entity.process_group,"*PROCESS*")
| expand dt.source_entity
| fieldsAdd dt.entity.process_group
| fieldsAdd dt.entity.host
| fieldsAdd dt.source_entity
| fields dt.source_entity, records = arraySum(count), joinMe = "*"
| sort records desc
| limit 50
//| join [ fetch dt.entity.host ], on: { left[dt.source_entity] == right[id] }, kind:leftOuter, prefix: "host."
| join [ fetch dt.entity.process_group_instance ], on: { left[dt.source_entity] == right[id] }, kind:leftOuter, prefix: "pgi."

| join [
timeseries total = sum(dt.log.status_per_entity_count, default: 0)
| fields total = arraySum(total), joinMe="*"
], on: joinMe

| fields
dt.source_entity=toString(dt.source_entity), percentage = (records / right.total) * 100,
name=coalesce(
pgi.entity.name
)

i need one more colunm whit hostane

[raksh_hitha · Accepted solution]

Hi Gasperetta 🙂

Try this out!
timeseries count = sum(dt.log.status_per_entity_count, default: 0), by:{dt.source_entity,dt.entity.process_group,dt.entity.host}
| filter isNotNull(dt.source_entity)
| filter matchesValue(dt.entity.process_group,"*PROCESS*")
| expand dt.source_entity
| fieldsAdd dt.entity.process_group
| fieldsAdd dt.entity.host
| fieldsAdd dt.source_entity
| fieldsAdd hostname = entityName(dt.entity.host)
| fields dt.source_entity, dt.entity.host, hostname, records = arraySum(count), joinMe = "*"
| sort records desc
| limit 50
| join [ fetch dt.entity.process_group_instance ], on: { left[dt.source_entity] == right[id] }, kind:leftOuter, prefix: "pgi."

| join [
timeseries total = sum(dt.log.status_per_entity_count, default: 0)
| fields total = arraySum(total), joinMe="*"
], on: joinMe

| fields
dt.source_entity=toString(dt.source_entity), percentage = (records / right.total) * 100,
name=coalesce(pgi.entity.name), hostname, hostID = pgi.belongs_to

[gasperetta]

Thank you so much