Dashboards & Visualizations

Need help with query

Mrig342
Contributor

Hi,

I am getting  the below table using the query "index=main host="abcde" | rex field=_raw "(?ms)Node\s+Name\s:\s(?<Node_Name>\w+\S+)" | rex field=_raw "(?ms)Node\sState\s:\s(?<Node_State>[\w\s]+\w)\s+Number | eval Result=if('Node_State'=='Running', "Ok", "NotOk") | table Node_Name,Node_State,Result"

Node_Name    Node_State                       Result

abc                      Stopped                               NotOk

cde                      Running                                NotOk

abc                      Running                                NotOk

xyz                       Stopped                               NotOk

the                       Running                                NotOk

abc                      Partially running                NotOk

abc                      Stopped                                NotOk

xyz                       Running                                NotOk

the                       Running                                NotOk

abc                      Running                                NotOk

 

Is there anything wrong with my query in the eval command..? I want the "Result" field to be "Ok" if Running and "NotOk" for any other state. But here it seems not working as expected.

Please help modify the query to get the output in desired way.

Thank you.

Labels (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
| eval Result=if(Node_State=="Running", "Ok", "NotOk") 

View solution in original post

to4kawa
Ultra Champion
| eval Result=if(Node_State=="Running", "Ok", "NotOk") 

Mrig342
Contributor

Hi to4kawa,

Thank you very much..!! It is now working as desired.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...