Archive

Why is there a problem when passing a command through a variable in map-command?

Path Finder

Hi guys,

| inputlookup Threshold_Perfil.csv 
| join perfil max=0 
    [| inputlookup Perfis_Threshold.csv 
    | fields perfil counter object 
    | dedup perfil counter object ] 
| eval counter= "counter='"."".counter.""."' " 
| eval object= " object='".object."' " 
| eval cmdline= " (".counter.object.") OR " 
| stats values(cmdline) as cmdline by host perfil 
| mvcombine delim="," cmdline 
| head 10 
| map search="earliest=-1h index="main" $cmdline$ sourcetype="nullableone" | stats count by object counter"

I'm using search above trying to pass a collection of counter and objects to make my search...

(counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) 

I have many servers and I want to check if Splunk is collecting correctly in each server, but when I'm passing my "cmdline" my map command is not running because splunk adds quotes after and before "cmdline" field.

earliest=-1h index=main " (counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) OR (counter='Temperatura' object='Temperatura' ) OR (counter='network_updown' object='ping' ) OR (counter='snmpwalk' object='bgp_router_status' ) OR " sourcetype=nullableone | stats count by object counter'.

If there is another way to do this I'll be happy to see.

1 Solution

SplunkTrust
SplunkTrust

Give this a try

| inputlookup Threshold_Perfil.csv 
| join perfil max=0 
    [| inputlookup Perfis_Threshold.csv 
    | fields perfil counter object 
    | dedup perfil counter object ] 
|  eval counter="counter='".counter."' " 
| eval object=" object='".object."' " 
| eval cmdline= "(".counter.object.")" 
| stats values(cmdline) as cmdline by host delim=" OR " | nomv cmdline 
| head 10 
| map search="search earliest=-1h index="main" [gentimes start=-1 | eval search=\"$cmdline$\" | rex mode=sed field=search "s/\\\"//g" | table search]  sourcetype="nullableone" | stats count by object counter"

View solution in original post

Esteemed Legend

Also, see this Q&A for a super-flexible general approach to handle this kind of thing:

https://answers.splunk.com/answers/719456/how-to-prevent-the-map-command-from-encapsulating.html?chi...

0 Karma

SplunkTrust
SplunkTrust

Give this a try

| inputlookup Threshold_Perfil.csv 
| join perfil max=0 
    [| inputlookup Perfis_Threshold.csv 
    | fields perfil counter object 
    | dedup perfil counter object ] 
|  eval counter="counter='".counter."' " 
| eval object=" object='".object."' " 
| eval cmdline= "(".counter.object.")" 
| stats values(cmdline) as cmdline by host delim=" OR " | nomv cmdline 
| head 10 
| map search="search earliest=-1h index="main" [gentimes start=-1 | eval search=\"$cmdline$\" | rex mode=sed field=search "s/\\\"//g" | table search]  sourcetype="nullableone" | stats count by object counter"

View solution in original post

Esteemed Legend

Exactly what I was going to propose.

0 Karma

SplunkTrust
SplunkTrust

@ppatrikfr do you have some sample values for cmdline. Also do you want to use it as text filter or key value pair? From he query seems like it is a text filter.

Also is the issue while running above in Splunk Search window or in Dashboard?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Path Finder

cmdline =

(counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) OR (counter='Temperatura' object='Temperatura' ) OR (counter='network_updown' object='ping' ) OR (counter='snmpwalk' object='bgp_router_status' ) OR

I just want splunk to identify as search command but those quotes are making them just a text filter. Also I'm running in window not dashboard.

0 Karma