topic Use EVAL and Case for Windows EventCodes to provide information in table output. in Splunk Search

Use EVAL and Case for Windows EventCodes to provide information in table output.

JDukeSplunk — Tue, 04 Aug 2015 18:17:32 GMT

Using this code I am able to generate a table for IIS Application Pool specific errors. With the eval-case providing a little info about the EventCode.

(host=stwweb0* NOT host=stwweb0*I) sourcetype=WinEventLog:System SourceName="Microsoft-Windows-WAS"  NOT 5186 | rex field=Message "(?i) pool (?P<Pool>[^ ]+)" |eval EventNumber=case(EventCode=5009 ,"5009 Terminated Unexpectedly",EventCode=5011,"5011 Communication Error",EventCode=5012,"5012 exceeded time limits during start up",EventCode=5013,"5013, exceeded time limits during shut down" ,EventCode=5014,"5014, internal error in its process management",EventCode=5074,"5074, worker process reached its allowed processing time limit",EventCode=5079,"5079, An administrator has requested a recycle",EventCode=5076,"5076, scheduled recycle time",EventCode=5138,"5138, failed to stop a listener channel for protocol 'http' in the allotted time",EventCode=5080,"5080, Recycled due to system settings change",EventCode=5010,"5010 Ping Timeout") |stats count by EventCode Pool EventNumber|eval Pool=Pool."-".count | stats list(Pool) as "Pool Count" by EventCode EventNumber

This returns a happy little list.
The problem is if there is no specific eval-case statement for the EventCode it gets dropped from the table output. I am looking for a way to still return Pool and EventCode even if no EventNumber exists. OR, the lump all non-specified EventCodes into an "Other" category.

Any help is appreciated, Thanks in advance! JD

Re: Use EVAL and Case for Windows EventCodes to provide information in table output.

somesoni2 — Tue, 04 Aug 2015 19:02:10 GMT

Just add a default value condition in the eval-case of yours, like this

(host=stwweb0* NOT host=stwweb0*I) sourcetype=WinEventLog:System SourceName="Microsoft-Windows-WAS"  NOT 5186 | rex field=Message "(?i) pool (?P<Pool>[^ ]+)" |eval EventNumber=case(EventCode=5009 ,"5009 Terminated Unexpectedly",EventCode=5011,"5011 Communication Error",EventCode=5012,"5012 exceeded time limits during start up",EventCode=5013,"5013, exceeded time limits during shut down" ,EventCode=5014,"5014, internal error in its process management",EventCode=5074,"5074, worker process reached its allowed processing time limit",EventCode=5079,"5079, An administrator has requested a recycle",EventCode=5076,"5076, scheduled recycle time",EventCode=5138,"5138, failed to stop a listener channel for protocol 'http' in the allotted time",EventCode=5080,"5080, Recycled due to system settings change",EventCode=5010,"5010 Ping Timeout",1=1,"Other") |stats count by EventCode Pool EventNumber|eval Pool=Pool."-".count | stats list(Pool) as "Pool Count" by EventCode EventNumber

Re: Use EVAL and Case for Windows EventCodes to provide information in table output.

JDukeSplunk — Tue, 04 Aug 2015 20:54:43 GMT

That got it 1=1,"Google It".

Pasting my cleaned up version of this in case someone else needs to monitor App Pools the way we do.

 sourcetype=WinEventLog:System SourceName="Microsoft-Windows-WAS"  NOT 5186 NOT 5076 | rex field=Message "(?i) pool (?P<Pool>[^ ]+)"|eval Description=case(EventCode=5009 ,"Terminated Unexpectedly",EventCode=5011,"Communication Error",EventCode=5013,"Exceeded time during shut down" ,EventCode=5074,"Exceeded allowed processing time",EventCode=5079,"Administrator recycle",EventCode=5076,"Scheduled recycle time",EventCode=5080,"Pool settings changed",EventCode=5010,"Ping Timeout",1=1,"Google It..") |stats count by EventCode Description Pool