Archive

see results of a rex command

Explorer

i have this rex code to extract the string from an event field:

| rex "(?\d{1,2})\s+hours?\s+ago"
| eval process=case(Time<4, "Process Up", true(), "Process down")

this is the event field:
Event
0 minutes ago, vmkid-p4rbdb03.lm.lmig.com, windows 6.3.9600.
1 minute ago, vmpid-h4eip001.lm.lmig.com, windows 6.3.9600.

What i wanted to do is extract the 1st string w/out the minute(s) ago and use an argument to check if this is less than 4, if it is i want to label it "Process up" and if not, it should be "Process down"

my code above is not working as it's marking all servers with less than 4 as Process down. that's why i wanted to see the results for the rex command

can you help me?

thank you!

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this run anywhere search:

| makeresults 
| eval data="5 minutes ago, vmkid-p4rbdb03.lm.lmig.com, windows 6.3.9600.:1 minute ago, vmpid-h4eip001.lm.lmig.com, windows 6.3.9600." 
| makemv data delim=":" 
| mvexpand data 
| rex field=data "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")

On your prod data you should try:

.. | rex field=_raw "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this run anywhere search:

| makeresults 
| eval data="5 minutes ago, vmkid-p4rbdb03.lm.lmig.com, windows 6.3.9600.:1 minute ago, vmpid-h4eip001.lm.lmig.com, windows 6.3.9600." 
| makemv data delim=":" 
| mvexpand data 
| rex field=data "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")

On your prod data you should try:

.. | rex field=_raw "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")

View solution in original post

0 Karma

Explorer

thank you so much!

0 Karma

Explorer

is there a way to make the data generic? i have multiple search results.

0 Karma

SplunkTrust
SplunkTrust

I didn't get you. could you pls elaborate ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!