topic Re: help in eval in Splunk Search

help in eval

marees123 — Thu, 30 Jul 2015 06:32:16 GMT

Hi Guys,

Need a help. I have two types of logs.

nwfin1swt2 : 2015 Jul 27 23:01:29 CDT: %SATCTRL-FEX101-2-SATCTRL: FEX-101 Module 1: Cold boot
nwfin2sw1001 26: Jul 27 15:58:36.267: %SYS-CFC7-5-RESTART: System restarted -

i created a query to list these logs in a table format...

*swt* "cold boot" OR "system restarted" | rex "(?i) Module 1: (?<coldboot>\w+\s+\w+)" | rex "(?i) %SYS-CFC[1-9]-5-RESTART: (?<restart>\w+\s+\w+)" | eval state=coldboot+restart | table host, state, _time

trying to bring the both results in the column called state with "eval state=coldboot+restart". im not getting in the column state. please help me to sort this out.

host                 state         _time
nwfin1swt2                  2015-07-27 23:01:29
nwfin2sw1001                  2015-07-27 15:58:36.267

Re: help in eval

aholzel — Thu, 30 Jul 2015 08:19:43 GMT

I assume that you are trying to concatenate the fields "coldboot" and "restart" in the field "state" in that case you need to use a "." and not a "+" to get them both in "state". Now you are trying to count them.

Re: help in eval

marees123 — Thu, 30 Jul 2015 08:43:24 GMT

Hi aholze,

thanks for the reply.

yes. i tried that as well. eval state = coldboot.restart

still its not working.

Re: help in eval

marees123 — Thu, 30 Jul 2015 08:44:33 GMT

i tried state = coldboot." ".restart as well.. no results....

Re: help in eval

aholzel — Thu, 30 Jul 2015 09:21:00 GMT

do you get any data if you try them individually?

.... | table host coldboot restart _time

and just to be sure you could add the "field=_raw" parameter to the rex command:

... | rex field=_raw "YOUR REGEX HERE"

Re: help in eval

krishnarajapant — Thu, 30 Jul 2015 09:23:11 GMT

Hi,

I believe you have to give space after the field names in eval expression.

swt "cold boot" OR "system restarted" | rex "(?i) Module 1: (?w+s+w+)" | rex "(?i) %SYS-CFC[1-9]-5-RESTART: (?w+s+w+)" | eval state= coldboot + restart | table host, state, _time

-Krishna Rajapantula.

Re: help in eval

krishnarajapant — Thu, 30 Jul 2015 09:23:55 GMT

Hi,

I believe you have to give space after the field names in eval expression.

swt "cold boot" OR "system restarted" | rex "(?i) Module 1: (?w+s+w+)" | rex "(?i) %SYS-CFC[1-9]-5-RESTART: (?w+s+w+)" | eval state= coldboot + restart | table host, state, _time

-Krishna Rajapantula.

Re: help in eval

marees123 — Thu, 30 Jul 2015 09:30:56 GMT

Hi Krishna...

thanks... i tried.. but no output 😞

Re: help in eval

marees123 — Thu, 30 Jul 2015 09:33:16 GMT

yes... i'm getting results if i use seperately...concatenation is not working.

Re: help in eval

aholzel — Thu, 30 Jul 2015 09:47:42 GMT

aaaa I think I see it.. in your regex you forgot the slash in front of w+ and s+ so that gives you empty fields.. I tested and this should work:

swt "cold boot" OR "system restarted" 
| rex "(?i) Module 1: (?<coldboot>\w+\s+\w+)" 
| rex "(?i) %SYS-CFC[1-9]-5-RESTART: (?<restart>\w+\s+\w+)" 
| eval state=coldboot." ".restart 
| table host, state, _time

Re: help in eval

marees123 — Thu, 30 Jul 2015 10:08:42 GMT

Hi Aholzel,

the same script only i used earlier.

eventtype = net swt "cold boot" OR "system restarted"
| rex "(?i) Module 1: (?P\w+\s+\w+)"
| rex "(?i) %SYS-CFC[1-9]-5-RESTART: (?P\w+\s+\w+)"
| eval state=coldboot." ".restart
| table host, state, _time

where did i miss "".. please let me know. thanks.

Re: help in eval

marees123 — Thu, 30 Jul 2015 10:30:32 GMT

if i display coldboot and restart seperately, im getting results.

Re: help in eval

krishnarajapant — Thu, 30 Jul 2015 10:35:07 GMT

Hi,

I'm not sure why it isnot working for you. I have tested this in my environment. Did you try in your eval expression eval state= field1 + field2? space between field1, + and field2?

-Krishna Rajapantula

Re: help in eval

marees123 — Thu, 30 Jul 2015 10:57:51 GMT

yes krishna... tried the same and used . as well... donno y... still searching....

Re: help in eval

aholzel — Thu, 30 Jul 2015 11:39:10 GMT

I see the slash is then probably only missing here because you didn't put everything in a code sample block.

I did this query to test and then everything is working:

index=* earliest=-10s@s
| eval colddata="nwfin1swt2 : 2015 Jul 27 23:01:29 CDT: %SATCTRL-FEX101-2-SATCTRL: FEX-101 Module 1: Cold boot" 
| eval restartdata="nwfin2sw1001 26: Jul 27 15:58:36.267: %SYS-CFC7-5-RESTART: System restarted -"
| rex field=colddata "(?i) Module 1: (?<coldboot>\w+\s+\w+)"
| rex field=restartdata "(?i) %SYS-CFC[1-9]-5-RESTART: (?<restart>\w+\s+\w+)"
| eval status=coldboot." ".restart
| table coldboot restart status

Can you test if that is also working in your environment I did this in Splunk 6.2.3

Re: help in eval

marees123 — Thu, 30 Jul 2015 14:28:03 GMT

Hi aholzel,

its listing all devices, and all results getting filled with same results. please check the below logs for your reference.

host coldboot restart status
lb01b Cold boot System restarted Cold boot System restarted
lb01b Cold boot System restarted Cold boot System restarted
lb01b Cold boot System restarted Cold boot System restarted

Re: help in eval

somesoni2 — Thu, 30 Jul 2015 15:23:42 GMT

Try this

 *swt* "cold boot" OR "system restarted" | rex "(?i) Module 1: (?<coldboot>\w+\s+\w+)" | rex "(?i) %SYS-CFC[1-9]-5-RESTART: (?<restart>\w+\s+\w+)" | eval state=coalesce(coldboot,"")+coalesce(restart,"") | table host, state, _time

Since both the fields appear in different events, one will have null value when other is not null. The coalesce command will take the first not null value (so null value for coldboot and restart will be replaced by empty string) and the concatenation would work fine.

Re: help in eval

marees123 — Fri, 31 Jul 2015 04:58:12 GMT

thanks a lot. it worked..... 🙂 awesome...

thanks again,

Re: help in eval

ohlafl — Fri, 31 Jul 2015 08:45:48 GMT

What does *swt* "cold boot" OR "system restarted" imply?

Would this method be possible to use with two fields where the regex is replaced by getting data directly from a value?

Re: help in eval

marees123 — Mon, 03 Aug 2015 09:32:28 GMT

yes.. this will give the raw results which contains the words cold boot and system restarted.. like below

nwfin1swt2 : 2015 Jul 27 23:01:29 CDT: %SATCTRL-FEX101-2-SATCTRL: FEX-101 Module 1: Cold boot
nwfin2sw1001 26: Jul 27 15:58:36.267: %SYS-CFC7-5-RESTART: System restarted -