Closed philrz closed 4 months ago
Verified in Zui commit b4ed51d.
As shown in the attached video, now the right-click Pivot to Values from the fused table isolates the expected records.
https://github.com/brimdata/zui/assets/5934157/bbfd188c-4a4f-4a65-988f-5fed844a5d12
Repro is with Zui commit 942b10f.
A common workflow for our pcap users is to do a
count() by _path
to see categories of Zeek events and then right-click Pivot to Values to see the individual records for a particular category, e.g.,http
.As shown in the attached video, this workflow can be foiled when Suricata are also generated from the pcap. The Suricata records lack a
_path
field and therefore end up witherror(missing)
in the output ofcount() by _path
. If the user does Pivot to Values on the original output, everything still works fine. However, if they follow the app's guidance and applyfuse
to first turn the aggregation output into a tidy table, the Pivot to Values silently fails.https://github.com/brimdata/zui/assets/5934157/186aa0ce-7de6-4d49-bce7-6bc55b224c9d
As shown in the video, the error in DevTools console looks like:
Peeking at the code, it appears that the app is just not prepared to deal with the Zed "union" values that result from applying
fuse
. I think I see a possible fix, so I'll put up a PR.