topic Looping if condition in for loop and display different tables in Splunk Search

Looping if condition in for loop and display different tables

k_harini — Sun, 22 Jan 2017 03:52:36 GMT

I have a table with 10 records. 2 rows for each host - say AUX0001 to AUX0005. For each host, 2 processes occur: the status and time range. AUX0001 disp.exe abcded green running , AUX0001 wxze.exe red running. In this way it is present for all the hosts..
My requirement - if both processes are green, host should display only once for disp.exe. if both are red, then both processes should be displayed. If one is green and one is red , it should be red with that process name be it disp.exe or wxze.exe. This looks simple. but unable to achieve this.

I tried several ways - Should i have to loop for each host? I'm not getting the desired result.

index="xxx" sourcetype="yy" |fields name description dispstatus textstatus starttime elapsedtime pid source|eval host_source = mvindex(split(source,"\\"),5)|eventstats count(eval(dispstatus="Green")) as green_count  count(eval(dispstatus="Red")) as red_count by host_source|eval desc_test = case(green_count ==2 OR red_count ==2,"Dispatcher", red_count ==1 AND description="watchdog" ,"watch", red_count ==1 AND description=" Dispatcher " ," Dispatcher ")|table host_source description dispstatus desc_test|where description=desc_test

Can someone please help me here? Thanks a lot

Re: Looping if condition in for loop and display different tables

DalJeanis — Sun, 22 Jan 2017 04:27:49 GMT

STATUS           DISPLAY     
DISP   WATCH     DISP   WATCH   
GREEN  GREEN     GREEN 
GREEN  RED              RED
RED    GREEN     RED   
RED    RED       RED    RED

okay, if either process is red, then that process should display. On the other hand, if both processes are green, then DISP should show green.

Try this for test code -

index="xxx" sourcetype="yy" 
| fields name description dispstatus textstatus starttime elapsedtime pid source
| eval host_source = mvindex(split(source,"\\"),5)
| eventstats count(eval(dispstatus="Green")) as green_count by host_source
| eval desc_test = If( (dispstatus="Red") OR (green_count==2 AND description=" Dispatcher "),"Pass","Block")
| table host_source description dispstatus desc_test
| sort 0 host_source description

If those results seem right, then use this for the actual code

index="xxx" sourcetype="yy" 
| fields name description dispstatus textstatus starttime elapsedtime pid source
| eval host_source = mvindex(split(source,"\\"),5)
| eventstats count(eval(dispstatus="Green")) as green_count by host_source
| search (dispstatus="Red") OR (green_count==2 AND description=" Dispatcher ")
| table host_source description dispstatus
| sort 0 host_source description

Re: Looping if condition in for loop and display different tables

k_harini — Sun, 22 Jan 2017 10:31:43 GMT

Thanks so much for your response.. I tried this.. it worked.. instead of green_count = 2 , I gave dispstatus = green, 1 green process also got displayed along with red ones.. Thanks a lot.. I got confused..

Re: Looping if condition in for loop and display different tables

DalJeanis — Mon, 23 Jan 2017 14:49:37 GMT

You're welcome.

The little results chart I made helped me simplify the question. There was only one condition that ever showed green (green==2), so from there it was easy.