How to show true keyword and green tick on publish of any events

[aditsss]

Hi Team,

I have below query:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"

I want a true keyword and a green tick every time I receive this  "ReadFileImpl - ebnc event balanced successfully"

Something like this:

"ReadFileImpl - ebnc event balanced successfully"       true              tick mark

If this appears "ReadFileImpl - ebnc event balanced successfully" 8 times in a day I want each statement separate with a true keyword and green tick.

Can someone guide me here.

[PickleRick]

That sounds kinda pointless. You're searching for this text so it's only natural that you find this text. There is no way for your search to match events which do not have this text.

What is the purpose of this exercise then?

[gcusello]

Hi @aditsss,

to add the "True" keyword it's easy, you have only to use the eval command with the option "searchmatch" (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/ConditionalFunctions#searchmatch....), in this way:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully","True","")

Even if, putting the string "ReadFileImpl - ebnc event balanced successfully"  in the main search, al the events you have as results are "true" by definition and you don' have events without the true keyword.

For the green tick is less easy because you have to use a JS and a CSS, you should see in the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603) where you can find the "Table Icon Set (Rangemap)" dashboard example that has this feature and gives you the JS and the CSS.

Ciao.

Giuseppe

[aditsss]

@gcusello 

I am getting below error by using below query:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully","True","")

Error in 'EvalCommand': The arguments to the 'searchmatch' function are invalid.

Could you please guide.

[gcusello]

Hi @aditsss.

sorry I forgot a parenthesis:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully"),"True","")

 Ciao.

Giuseppe

[aditsss]

@gcusello 

How can I make below query as statistics

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully"),"True","")

Like this :

ebnc event balanced successfully               True

[gcusello]

Hi @aditsss,

when you found th events, you can use the stats command:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully"),"True","")
| stats count

but, as I said, if you put the keyword in the main search, all the results are true, so you need only the count of events, so you could semplify your search:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| stats count

It's different if you want to count the occurrences of the string and also the other events, but you have to modify the main search:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" 
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully"),"True","False")
| stats count BY keyword

 Ciao.

Giuseppe

[aditsss]

@gcusello 

I dont want count

I want like this:

ebnc event balanced successfully                                  True

ebnc event balanced successfully                                   True

ebnc event balanced successfully                                   True

means whenever "ebnc event balanced successfully" occur TRUE keyword should be there.

[gcusello · Accepted solution]

Hi @aditsss,

let me understand: you want a table where each row contains only: "ebnc event balanced successfully! and "True"?

in this case, you can use:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" 
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully"),"True","False")
| eval phrase="ReadFileImpl - ebnc event balanced successfully"
| table phrase keyword

then, if you want, you could add other fields to the table command (e.g. _time).

Ciao.

Giuseppe

[gcusello]

Hi @aditsss,

 good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[aditsss]

@PickleRick 

This is requirement that when ebnc event balanced come there should be TRUE keyword to make it sure this happen.

Could you please guide regarding query. 

[PickleRick]

Ok, but if there is no such event, you will not have anything in your results. So just adding a static "true" to every returned row of results seems silly. The events don't change as such.

[aditsss]

@PickleRick 

This is only requirement

@PickleRick @gcusello  could you please guide me with the query I post.

I want like this

Ebnc events successfully balanced.       True

Whenever this "ebnc events successfully balanced" there should be true keyword.