Getting Data In

Need seperate count for UP and DOWN Peer

jerinvarghese
Communicator

Hi All,

I have a query to display some BGP neighbour UP or DOWN.

Output looks like
nodelabel Status PEER_IP Time_CST
Device1 UP 10.253.226.10 01/08/20 02:03:53
Device2 DOWN 10.253.140.89 01/08/20 00:26:54

Query is :

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST

I need a help, want to display how many UP and DOWN peers there.

0 Karma
1 Solution

TISKAR
Builder

Hello,

First method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST
| eval number_Up=if(Status="UP",1,0), number_Down=if(Status="DOWN",1,0)
| stats sum(number_Up) as UP, sum(number_Down) as DOWN

Second method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
    | rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
    | rex "peer: (?.*), eventseverity"
    | eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
    | rename _time as Time_CST
    | fieldformat Time_CST=strftime(Time_CST,"%x %X")
    | dedup nodelabel sortby - Time_CST
    | table nodelabel Status PEER_IP Time_CST
    | stats count(eval(Status="UP")) as UP, count(eval(Status="DOWN")) as DOWN

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253.*"
| rex "peer: (?<PEER_IP>.*), eventseverity"
| stats count(eval(searchmatch("XOM-rearm"))) AS UP count(eval(searchmatch("XOM-falling"))) AS DOWN values(PEER_IP) AS PEER_IP by nodelabel

hi, only count up & down by nodelabel.

0 Karma

TISKAR
Builder

Hello,

First method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST
| eval number_Up=if(Status="UP",1,0), number_Down=if(Status="DOWN",1,0)
| stats sum(number_Up) as UP, sum(number_Down) as DOWN

Second method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
    | rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
    | rex "peer: (?.*), eventseverity"
    | eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
    | rename _time as Time_CST
    | fieldformat Time_CST=strftime(Time_CST,"%x %X")
    | dedup nodelabel sortby - Time_CST
    | table nodelabel Status PEER_IP Time_CST
    | stats count(eval(Status="UP")) as UP, count(eval(Status="DOWN")) as DOWN
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jerinvarghese
Try

YOUR_SEARCH | stats count(eval(Status="UP")) as UP_Count count(eval(Status="DOWN")) as DOWN_Count
0 Karma

jerinvarghese
Communicator

thanks for the query it helped.

0 Karma

WalshyB
Path Finder

use something like this on the end?

| stats count as Total count(eval(Status=="UP")) as "up_count" count(eval(Status=="DOWN")) as "down_count"

Or

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| dedup nodelabel
| stats dc(PEER_IP) as Total by Status

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...