Archive

hellp with charting search results

Explorer

hello, i'm hoping to get help on this. been working on it for several days, so i thought to reach out to the experts.

i am trying to chart the percentage of a process (up/down). here's my code:

search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values(*) as * by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| eval process_up=case(Time>4,"Process Down", true(),"Process Up")
| eval host = lower(host)
| table host process_up
| stats count by process_up

for some reason the count is only showing the process_up and not the process_down.
i expect to see results like this:
process_up 200
process_down 12

and then do a pie chart based on the expected results.

can you help this newbie?

thank you so much

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Try this :

    .. | eval process=case(Time>4,"Process Down", 1==1,"Process Up")
    | stats count by process

If this does not show Process Up count then you should check after | eval process=case(Time>4,"Process Down", 1==1,"Process Up") do Time has anything lower than 4 ? then only it will be counted as "Process Up" otherwise it won't show.

Builder

Also, in binary decisions, you can use the "if" statement, which would have caught this:
| eval process=if(Time>4,"Process Down","Process Up")

0 Karma

Explorer

thank you jpolvino! i tried the code above but it didn't give me process.

0 Karma

Explorer

i tried the 'if' and also didn't show process.

0 Karma

Builder

Please run this and post the results:
search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values() as by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| stats count by Time

The last line will show the different values for Time, and the counts of those. It might be that Time is not defined or doesn't have the values you think it has.

0 Karma

Explorer

hi jpolvino - no results found

212 events
statistics 0

0 Karma

Explorer

wait i made a mistake. running the search again

0 Karma

Explorer

okay not showing any for Time

0 Karma

Builder

So Time field is undefined. Is this the line you are using to set Time?
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"

If so, then change it to:

| rex field=_raw "(?<Time>\d{1,2})\s+hours?\s+ago"

Also, please explain what Time is supposed to contain. The line right above assumes it is the number of "hours ago" logged.

0 Karma

Explorer

this is a sample of the line:
Event
0 minutes ago, vmpit-p4cti002.lm.lmig.com, windows 6.3.9600

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!