humio / issues

Issue Tracker for Humio
4 stars 2 forks source link

Replace function: Doesn't always update existing fields? #97

Closed gwtwod closed 4 years ago

gwtwod commented 4 years ago

Humio Version: 1.6.3--build-7700--sha-89765c301 (and 1.6.2) Browser Version: Chrome Version 76.0.3809.100 (Official Build) (64-bit)

The replace() function seems a bit weird now, it doesnt always seem to modify existing fields?

Example search from the Sandbox tutorial dataset:

wikipedia products office
| replace(regex="office", with="playground", field=url, as=new_url)
| replace(regex="playground", with="bakery", field=new_url, as=new_url)

After this query I get these fields in the left-side field menu

"url": /products/office/92
"new_url" "/products/playground/92"

If I add a | table([url, new_url]) at the end then I get the expected result:

"url": "/products/office/92"
"new_url": "/products/bakery/92"

I've also seen the same happen after trying to replace() values in a field I use with timechart(field)

andejens commented 4 years ago

Thx - we'll take a look

gwtwod commented 4 years ago

This still happens in version 1.6.5--build-7284--sha-9815b655e.

Heres two screenshots demonstrating the issue as well. I suspect the replace() function just doesn't update the field stats in the left-menu, so it looks like they haven't been changed. But if I try to use those fields in a search I can see they actually have been changed as expected.

replace_bug_1

replace_bug_2

andejens commented 4 years ago

I apologise - no progress has been made - I have raised the priority internally.

chvitved commented 4 years ago

Thanks for reporting. This is fixed in 1.6.6