Archive

hellp with charting search results

owie6466
Explorer

hello, i'm hoping to get help on this. been working on it for several days, so i thought to reach out to the experts.

i am trying to chart the percentage of a process (up/down). here's my code:

search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values(*) as * by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| eval process_up=case(Time>4,"Process Down", true(),"Process Up")
| eval host = lower(host)
| table host process_up
| stats count by process_up

for some reason the count is only showing the process_up and not the process_down.
i expect to see results like this:
process_up 200
process_down 12

and then do a pie chart based on the expected results.

can you help this newbie?

thank you so much

Tags (1)
0 Karma

mayurr98
SplunkTrust
SplunkTrust

Try this :

    .. | eval process=case(Time>4,"Process Down", 1==1,"Process Up")
    | stats count by process

If this does not show Process Up count then you should check after | eval process=case(Time>4,"Process Down", 1==1,"Process Up") do Time has anything lower than 4 ? then only it will be counted as "Process Up" otherwise it won't show.

jpolvino
Builder

Also, in binary decisions, you can use the "if" statement, which would have caught this:
| eval process=if(Time>4,"Process Down","Process Up")

0 Karma

owie6466
Explorer

thank you jpolvino! i tried the code above but it didn't give me process.

0 Karma

owie6466
Explorer

i tried the 'if' and also didn't show process.

0 Karma

jpolvino
Builder

Please run this and post the results:
search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values() as by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| stats count by Time

The last line will show the different values for Time, and the counts of those. It might be that Time is not defined or doesn't have the values you think it has.

0 Karma

owie6466
Explorer

hi jpolvino - no results found

212 events
statistics 0

0 Karma

owie6466
Explorer

wait i made a mistake. running the search again

0 Karma

owie6466
Explorer

okay not showing any for Time

0 Karma

jpolvino
Builder

So Time field is undefined. Is this the line you are using to set Time?
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"

If so, then change it to:

| rex field=_raw "(?<Time>\d{1,2})\s+hours?\s+ago"

Also, please explain what Time is supposed to contain. The line right above assumes it is the number of "hours ago" logged.

0 Karma

owie6466
Explorer

this is a sample of the line:
Event
0 minutes ago, vmpit-p4cti002.lm.lmig.com, windows 6.3.9600

0 Karma