hellp with charting search results

[owie6466]

hello, i'm hoping to get help on this. been working on it for several days, so i thought to reach out to the experts.

i am trying to chart the percentage of a process (up/down). here's my code:

search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values(*) as * by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| eval process_up=case(Time>4,"Process Down", true(),"Process Up")
| eval host = lower(host)
| table host process_up
| stats count by process_up

for some reason the count is only showing the process_up and not the process_down.
i expect to see results like this:
process_up 200
process_down 12

and then do a pie chart based on the expected results.

can you help this newbie?

thank you so much

[mayurr98]

Try this :

    .. | eval process=case(Time>4,"Process Down", 1==1,"Process Up")
    | stats count by process

If this does not show Process Up count then you should check after | eval process=case(Time>4,"Process Down", 1==1,"Process Up") do Time has anything lower than 4 ? then only it will be counted as "Process Up" otherwise it won't show.

[jpolvino]

Also, in binary decisions, you can use the "if" statement, which would have caught this:
| eval process=if(Time>4,"Process Down","Process Up")

[owie6466]

thank you jpolvino! i tried the code above but it didn't give me process.

[owie6466]

i tried the 'if' and also didn't show process.

[jpolvino]

Please run this and post the results:
search index=wineventlog* sourcetype=WinEventLog:Application SourceName=Chef
| stats values() as by host
| rex field=host "(?[^.]+)."
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"
| stats count by Time

The last line will show the different values for Time, and the counts of those. It might be that Time is not defined or doesn't have the values you think it has.

[owie6466]

hi jpolvino - no results found

212 events
statistics 0

[owie6466]

wait i made a mistake. running the search again

[owie6466]

okay not showing any for Time

[jpolvino]

So Time field is undefined. Is this the line you are using to set Time?
| rex field=_raw "(?\d{1,2})\s+hours?\s+ago"

If so, then change it to:

| rex field=_raw "(?<Time>\d{1,2})\s+hours?\s+ago"

Also, please explain what Time is supposed to contain. The line right above assumes it is the number of "hours ago" logged.

[owie6466]

this is a sample of the line:
Event
0 minutes ago, vmpit-p4cti002.lm.lmig.com, windows 6.3.9600