Need seperate count for UP and DOWN Peer

[jerinvarghese]

Hi All,

I have a query to display some BGP neighbour UP or DOWN.

Output looks like
nodelabel Status PEER_IP Time_CST
Device1 UP 10.253.226.10 01/08/20 02:03:53
Device2 DOWN 10.253.140.89 01/08/20 00:26:54

Query is :

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST

I need a help, want to display how many UP and DOWN peers there.

[to4kawa]

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253.*"
| rex "peer: (?<PEER_IP>.*), eventseverity"
| stats count(eval(searchmatch("XOM-rearm"))) AS UP count(eval(searchmatch("XOM-falling"))) AS DOWN values(PEER_IP) AS PEER_IP by nodelabel

hi, only count up & down by nodelabel.

[TISKAR · Accepted solution]

Hello,

First method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST
| eval number_Up=if(Status="UP",1,0), number_Down=if(Status="DOWN",1,0)
| stats sum(number_Up) as UP, sum(number_Down) as DOWN

Second method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
    | rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
    | rex "peer: (?.*), eventseverity"
    | eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
    | rename _time as Time_CST
    | fieldformat Time_CST=strftime(Time_CST,"%x %X")
    | dedup nodelabel sortby - Time_CST
    | table nodelabel Status PEER_IP Time_CST
    | stats count(eval(Status="UP")) as UP, count(eval(Status="DOWN")) as DOWN

[kamlesh_vaghela]

@jerinvarghese
Try

YOUR_SEARCH | stats count(eval(Status="UP")) as UP_Count count(eval(Status="DOWN")) as DOWN_Count

[jerinvarghese]

thanks for the query it helped.

[WalshyB]

use something like this on the end?

| stats count as Total count(eval(Status=="UP")) as "up_count" count(eval(Status=="DOWN")) as "down_count"

Or

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| dedup nodelabel
| stats dc(PEER_IP) as Total by Status