topic Re: Strcat and lookups in Splunk Search

Strcat and lookups

mcwomble — Tue, 03 Apr 2012 06:55:57 GMT

I have a query regarding the use of the strcat functionality. The following search is used to generate and alarm condition.

index="ft" ftp | stats  count(eval(status="failed")) as fail_cnt   count(eval(status="success")) as success_cnt by user | strcat "[OPS:FTP:CRITICAL]{NODE:MON1}SFTP Connectivity " user host "  Please raise incident with userdescription" "userdetails ALARM_DESCRIPTION | eval CLEAR=case(success_cnt>0, "1")

It works fine except that the userdetails and userdescription within the strcat argument will not populate. Userdetails and userdescription are lookups from a file (using the user field) which are valid and will populate if defined in a table i.e

| table user success_cnt failed_cnt userdetails userdescription

Any help on this would be appreciated.

Re: Strcat and lookups

gkanapathy — Tue, 03 Apr 2012 07:25:01 GMT

It looks to me like you have mismatched " (quote) marks, but maybe that was just transcribed wrong. Use the eval + or . operators instead of strcat:

... | eval ALARM_DESCRIPTION = "String1" + user + host + " xyz" | ...

Re: Strcat and lookups

mcwomble — Wed, 04 Apr 2012 03:50:52 GMT

The problem here seems to be that no fields are passed on after the stats command.

Re: Strcat and lookups

gkanapathy — Wed, 04 Apr 2012 05:22:53 GMT

That is as designed. stats only outputs field specifically computed, and the split-by fields. You should either run the lookup again, or use first(fieldname) as fieldname in stats.