topic Re: hellp with charting search results in Dashboards & Visualizations

hellp with charting search results

owie6466 — Wed, 30 Sep 2020 01:40:43 GMT

hello, i'm hoping to get help on this. been working on it for several days, so i thought to reach out to the experts.

i am trying to chart the percentage of a process (up/down). here's my code:

search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values(*) as * by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| eval process_up=case(Time>4,"Process Down", true(),"Process Up")
| eval host = lower(host)
| table host process_up
| stats count by process_up

for some reason the count is only showing the process_up and not the process_down.
i expect to see results like this:
process_up 200
process_down 12

and then do a pie chart based on the expected results.

can you help this newbie?

thank you so much

Re: hellp with charting search results

mayurr98 — Fri, 09 Aug 2019 17:59:18 GMT

Try this :

    .. | eval process=case(Time>4,"Process Down", 1==1,"Process Up")
    | stats count by process

If this does not show Process Up count then you should check after | eval process=case(Time>4,"Process Down", 1==1,"Process Up") do Time has anything lower than 4 ? then only it will be counted as "Process Up" otherwise it won't show.

Re: hellp with charting search results

jpolvino — Fri, 09 Aug 2019 18:12:56 GMT

Also, in binary decisions, you can use the "if" statement, which would have caught this:
| eval process=if(Time>4,"Process Down","Process Up")

Re: hellp with charting search results

owie6466 — Fri, 09 Aug 2019 18:37:54 GMT

thank you jpolvino! i tried the code above but it didn't give me process.

Re: hellp with charting search results

owie6466 — Fri, 09 Aug 2019 18:40:09 GMT

i tried the 'if' and also didn't show process.

Re: hellp with charting search results

jpolvino — Fri, 09 Aug 2019 18:50:04 GMT

Please run this and post the results:
search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values() as by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| stats count by Time

The last line will show the different values for Time, and the counts of those. It might be that Time is not defined or doesn't have the values you think it has.

Re: hellp with charting search results

owie6466 — Fri, 09 Aug 2019 19:42:16 GMT

hi jpolvino - no results found

212 events
statistics 0

Re: hellp with charting search results

owie6466 — Fri, 09 Aug 2019 19:48:16 GMT

wait i made a mistake. running the search again

Re: hellp with charting search results

owie6466 — Fri, 09 Aug 2019 19:50:10 GMT

okay not showing any for Time

Re: hellp with charting search results

jpolvino — Fri, 09 Aug 2019 19:53:09 GMT

So Time field is undefined. Is this the line you are using to set Time?
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"

If so, then change it to:

| rex field=_raw "(?<Time>\d{1,2})\s+hours?\s+ago"

Also, please explain what Time is supposed to contain. The line right above assumes it is the number of "hours ago" logged.

Re: hellp with charting search results

owie6466 — Fri, 09 Aug 2019 20:21:22 GMT

this is a sample of the line:
Event
0 minutes ago, vmpit-p4cti002.lm.lmig.com, windows 6.3.9600