topic Re: how to trim output in All Apps and Add-ons

how to trim output

marees123 — Wed, 13 May 2015 14:29:14 GMT

Hi Experts,

i'm getting the below output in my search (index=LB example.domain.com* "monitor status *")

May 4 20:16:05 netloadBalance_1a notice mcpd[7457]: 01070727:5: Pool /Common/example.domain.com member /Common/192.168.2.24:443 monitor status up. [ /Common/tcp_443: up ] [ was up for 55hrs:23mins:26sec ]

i would like to get the output like

example.domain.com 192.168.2.24:443 monitor status up

please advise

Re: how to trim output

richgalloway — Wed, 13 May 2015 15:12:34 GMT

This should do the trick.

index=LB example.domain.com* "monitor status *" | rex "\/Common\/(?P<domain>[^ ]+).*\/(?P<status>[\d\.:]+ monitor status \w+\.)" | table domain status

Replace "<" and ">" with "<" and ">", respectively.

Re: how to trim output

marees123 — Wed, 13 May 2015 15:54:07 GMT

Thank you Richgalloway,

im getting the second output... 192.168.2.24:443 monitor status up

need to get the first output also which is the url name, like....

example.domain.com 192.168.2.24:443 monitor status up

Re: how to trim output

richgalloway — Wed, 13 May 2015 16:07:55 GMT

I've updated my answer. You may need to adjust the regex depending on if "/Common/" is a fixed string or not.

Re: how to trim output

marees123 — Wed, 13 May 2015 16:16:08 GMT

Thank you ....

Yes... It is working fine

can we concatenate that domain & status together?

Re: how to trim output

richgalloway — Wed, 13 May 2015 16:18:38 GMT

Certainly. Just use an eval like this eval foo=domain+" "+status

Re: how to trim output

marees123 — Wed, 13 May 2015 16:28:49 GMT

Sorry Richgalloway...

where do i need to insert this command... i'm poor in quries...

Re: how to trim output

richgalloway — Wed, 13 May 2015 16:31:19 GMT

Put it before the table command then change the table command to table foo.

Re: how to trim output

marees123 — Wed, 13 May 2015 16:33:43 GMT

you are awesome...

thanks a lot.. its working perfectly 🙂

Re: how to trim output

richgalloway — Wed, 13 May 2015 16:35:55 GMT

Great! Please accept the answer.

Re: how to trim output

marees123 — Wed, 13 May 2015 17:43:04 GMT

Hi Richgalloway

Sorry....

what we need to do to display like a below sentence...

example.domain.com monitor status changed to up/down on node 192.168.2.24:443

Re: how to trim output

richgalloway — Wed, 13 May 2015 17:52:59 GMT

You have most of what you need already. All you have to do is tweak the regex string and the eval:

index=LB example.domain.com* "monitor status *" | rex "\/Common\/(?P&lt;domain&gt;[^ ]+).*\/(?P&lt;node&gt;[\d\.:]+) monitor status (?P&lt;status&gt;\w+\.)" | eval sentence=domain+" monitor status changed to "+status+" on node "+node | table sentence

Re: how to trim output

marees123 — Wed, 13 May 2015 18:10:21 GMT

Thanks a lot ....:-)

Re: how to trim output

marees123 — Thu, 14 May 2015 07:35:12 GMT

Hi Richgalloway,

example.domain.com monitor status changed to down on node 192.168.2.24:443 2015-05-14 02:26:18
example.domain.com monitor status changed to down on node 192.168.2.24:443 2015-05-14 02:26:18
example.domain.com monitor status changed to down on node 192.168.2.24:443 2015-05-14 02:26:22
example.domain.com monitor status changed to up on node 192.168.2.24:443 2015-05-14 02:26:22
example.domain.com monitor status changed to up on node 192.168.2.24:443 2015-05-14 02:26:22
example.domain.com monitor status changed to up on node 192.168.2.24:443 2015-05-14 02:26:26

shall i get a single entry for down and up in a single search.... if the domain name and IP address is same...

Re: how to trim output

richgalloway — Thu, 14 May 2015 13:19:26 GMT

That's easily done using the dedup command.

index=LB example.domain.com* "monitor status *" | rex "\/Common\/(?P&lt;domain&gt;[^ ]+).*\/(?P&lt;node&gt;[\d\.:]+) monitor status (?P&lt;status&gt;\w+\.)" | dedup domain node | eval sentence=domain+" monitor status changed to "+status+" on node "+node | table sentence

Re: how to trim output

marees123 — Fri, 15 May 2015 06:32:38 GMT

Thank you:-)

but it is displaying only UP not down...

Re: how to trim output

richgalloway — Fri, 15 May 2015 14:32:10 GMT

It is displaying the most recent status. To show the most recent down and up states, change the dedup command to dedup domain node status.