topic Re: How to find the number of fields that consists "Passed" and also the Total number of fields available. in Splunk Search

How to find the number of fields that consists "Passed" and also the Total number of fields available.

vinod743374 — Mon, 28 Jun 2021 09:21:37 GMT

This is my sample data. i need the total "passed"

These are the Headers, Node Name _time, Anti-Spoofing, Rule Banner , Rule Http Rule Palo alto Username SSH Timeout Ssh Access Tacacs Telnet Rule console port config ntp server Result

NDL-ALM-GSD-BUS-FW-01

2021-06-24 17:27:35

Passed

USA-DNV-CUS-BUS-FW-02

2021-06-24 17:27:35

Passed

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

kamlesh_vaghela — Mon, 28 Jun 2021 09:30:32 GMT

@vinod743374

Can you please share sample _raw events and expected OP from that event?

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

vinod743374 — Mon, 28 Jun 2021 09:35:43 GMT

This is the _raw data i filtered like this. i want to know the count of the total "passed"

Dns Rule=Passed, HOSTNAME=Passed, username=Passed, ssh Timeout rule=Passed snmp rule=Passed, udld Rule=Passed, Enable Password=Passed, Snmp config rule=Passed, Line Vty 0 4 Timeout & acl=Passed, Line Con 0 timeout=Passed, Service Policy=Passed, Https Rule=Passed, Line Con 0=Passed, Line aux 0=Passed, Don't Username=Passed, Service Password Encryption=Passed, Aaa Server-GE=Passed, Line Vty 5 15=Passed, Image Verification=Passed, Bootp Server=Passed,Line Vty 0 4=Passed,

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

kamlesh_vaghela — Mon, 28 Jun 2021 09:41:59 GMT

@vinod743374

Can you please try this?

YOUR_SEARCH | rex field=_raw "=(?<a>Passed)" max_match=0 | eval count=mvcount(a) | fields - a

My Sample Search :

| makeresults | eval _raw="Dns Rule=Passed, HOSTNAME=Passed, username=Passed, ssh Timeout rule=Passed snmp rule=Passed, udld Rule=Passed, Enable Password=Passed, Snmp config rule=Passed, Line Vty 0 4 Timeout & acl=Passed, Line Con 0 timeout=Passed, Service Policy=Passed, Https Rule=Passed, Line Con 0=Passed, Line aux 0=Passed, Don't Username=Passed, Service Password Encryption=Passed, Aaa Server-GE=Passed, Line Vty 5 15=Passed, Image Verification=Passed, Bootp Server=Passed,Line Vty 0 4=Passed" |rename comment as "Upto Now is sample data only" | rex field=_raw "=(?<a>Passed)" max_match=0 | eval count=mvcount(a) | fields - a

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

vinod743374 — Mon, 28 Jun 2021 10:14:01 GMT

Thank you so much ,
its is working .
but if in the place of Passed, i have some Failed message like :

Critical - Pattern 'disable-http yes' was not found Pattern 'https yes' was not found

Can we count these Error Failed messages also ???
kindly help me with this also.

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

kamlesh_vaghela — Mon, 28 Jun 2021 10:17:33 GMT

@vinod743374

Can you please try this?

My Sample Search :

| makeresults | eval _raw="Dns Rule=Passed, HOSTNAME=Passed, username=Passed, ssh Timeout rule=Passed snmp rule=Passed, udld Rule=Passed, Enable Password=Passed, Snmp config rule=Passed, Line Vty 0 4 Timeout & acl=Passed, Line Con 0 timeout=Passed, Service Policy=Passed, Https Rule=Passed, Line Con 0=Passed, Line aux 0=Passed, Don't Username=Passed, Service Password Encryption=Passed, Aaa Server-GE=Passed, Line Vty 5 15=Passed, Image Verification=Passed, Bootp Server=Passed,Line Vty 0 4=Passed, xyz=Failed" |rename comment as "Upto Now is sample data only" | rex field=_raw "=(?<a>Passed)" max_match=0 | eval passed_count=mvcount(a) | fields - a | rex field=_raw "=(?<a>Failed)" max_match=0 | eval failed_count=mvcount(a) | fields - a

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

vinod743374 — Mon, 28 Jun 2021 10:27:33 GMT

Its not gonna workout ,
because there is no such "Failed" in the _raw

let me share you the _raw event of that . i just bold the failed message.

Dns Rule=Passed, HOSTNAME=Passed, username=Passed, ssh Timeout rule=Passed, Node Name="HUN-BUD-GE-COR-SW-01_stack.ROMA.AD", snmp rule=Passed, udld Rule=Passed, Enable Password=Passed, Snmp config rule=Passed, Line Vty 0 4 Timeout & acl=Passed, Line Con 0 timeout=Passed, Service Policy=Passed, Https Rule=Passed, Line Con 0=Passed, Line aux 0=Passed, Node Ip Address="10.198.4.1", Don't Username=Passed, Service Password Encryption=Passed, AaaServer-GE="Critical - Pattern 'aaa new-model' was found On line 28 'aaa new-model' Pattern 'aaa authentication login default group tacacs' was not found Pattern 'aaa authorization exec default group tacacs' was not found Pattern 'aaa accounting exec default start-stop group tacacs' was not found Pattern 'tacacs-server host 10.198.60.40' was not found Pattern 'tacacs-server host 10.198.40.40' was not found Pattern 'tacacs-server directed-request' was not found Pattern 'aaa authentication enable default group tacacs' was not found Pattern 'aaa accounting commands 15 default start-stop group tacacs' was not found", Line Vty 5 15=Passed, Image Verification=Passed, Bootp Server=Passed, Config Title="4/26/2021 01:03 PM - Running", Line Vty 0 4=Passed, Logging Rule=Passed, Banner Rule=Passed, Config Type=Running, Finger Rule=Passed, Http Server=Passed, Name Server=Passed, Pad Service=Passed,

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

kamlesh_vaghela — Mon, 28 Jun 2021 10:50:43 GMT

@vinod743374

Is that specific pattern that we can say Failed for this?

AaaServer-GE="Critical - Pattern 'aaa new-model' was found On line 28 'aaa new-model' Pattern 'aaa authentication login default group tacacs' was not found Pattern 'aaa authorization exec default group tacacs' was not found Pattern 'aaa accounting exec default start-stop group tacacs' was not found Pattern 'tacacs-server host 10.198.60.40' was not found Pattern 'tacacs-server host 10.198.40.40' was not found Pattern 'tacacs-server directed-request' was not found Pattern 'aaa authentication enable default group tacacs' was not found Pattern 'aaa accounting commands 15 default start-stop group tacacs' was not found"

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

vinod743374 — Mon, 28 Jun 2021 10:55:12 GMT

Yes,
the Content may changes for different Events.

"Critical - " is common in all the things the remaining gets changed.

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

kamlesh_vaghela — Mon, 28 Jun 2021 10:59:06 GMT

@vinod743374

Can you please try this?

YOUR_SEARCH | rex field=_raw "=(?<a>Passed)" max_match=0 | rex field=_raw "=\"(?<b>Critical\s-) " max_match=0 | eval passed_count=mvcount(a), failed_count=mvcount(b) | fields - a,b

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

vinod743374 — Mon, 28 Jun 2021 11:05:24 GMT

Thank you so much it is working.

Re: How to find the number of fields that consists "Passed" and also the Total number of fields available.

kamlesh_vaghela — Mon, 28 Jun 2021 11:10:21 GMT

Glad to help you @vinod743374

But you supposed to accept my last answer 🙂