topic Comparing multiple values for a result in Splunk Search

Comparing multiple values for a result

jerinvarghese — Mon, 13 Jul 2020 10:25:57 GMT

HI All,

need your help in below query. I use below query to get below output.

Query :

index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm

Output:

nodelabel Alarm Time Downtime Status count
CMDLA 10.207.31.222 2020-07-13 15:18:55 00:03:00 UP 2
NGQIT 10.201.68.17 2020-07-13 15:06:35 00:15:19 DOWN 6
EGCAI 158.29.241.86 2020-07-13 14:48:33 00:33:21 UP 2
MXMXC 10.253.208.70 2020-07-12 14:48:03 1+00:33:51 UP 1

Problem :

I want only output for below conditions.

> All DOWN must show.
> UP with only greater than 2 must be shows.
Please help me with the comparing search for this condition.

Re: Comparing multiple values for a result

richgalloway — Mon, 13 Jul 2020 13:04:19 GMT

Please explain your requirements further as "all DOWN" and "UP greater than 2" seem contradictory.

The latter is accomplished using where after stats.

index=nw_syslog | rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)" | stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm | where (Status="UP" AND count > 2)

Re: Comparing multiple values for a result

jerinvarghese — Mon, 13 Jul 2020 13:21:14 GMT

| where ((Status="UP" AND count > 2) OR Status="DOWN")

the above command worked. Thanks, your one liner help me think of this way.

Re: Comparing multiple values for a result

richgalloway — Mon, 13 Jul 2020 13:34:42 GMT

If your problem is resolved, then please click an "Accept as Solution" button to help future readers.