Classify into a group

[Kirthika]

Example logs

2022-08-19 08:10:53.0593|**Starting**

2022-08-19 08:10:53.5905|fff

2022-08-19 08:10:53.6061|dd

2022-08-19 08:10:53.6218|Shutting down

2022-08-19 08:10:53.6218|**Starting**

2022-08-19 08:10:53.6374|fffff

2022-08-19 08:10:53.6686|ddd

2022-08-19 08:10:53.6843|**Starting**

2022-08-19 08:10:54.1530|aa

2022-08-19 08:10:54.1530|vv

From this I have created three columns Devicenumber,  _time ,Description

If ** Starting ** message has followed by "Shutting down" mean, it should classify as good and if Starting message has not Shutting down mean, it should classify as bad.

From the above example, there should be 2 bad and one good.

If there is only one row which has only Starting and no shutting down recorded, in that case also , it should classify as bad

[inventsekar]

Nice SPL @ITWhisperer .. 

Hi @Kirthika .. pls check this SPL.. (the stats logic may needs to be fine-tuned)

source="testlogrex.txt" host="laptop" sourcetype="nov12"
| rex field=_raw "\|(?<msg>.+)$"
| stats sum(eval(case(msg=="**Starting**",1,msg=="Shutting down",-1))) as bad count(eval(case(msg=="**Starting**",1))) as starts
| eval good=starts-bad

this SPL gives this result.. 

bad starts good

5

7

2

The Sample logs and rex used here:

source="testlogrex.txt" host="laptop" sourcetype="nov12"
| rex field=_raw "\|(?<msg>.+)$"
| table _raw msg

_raw msg

2022-08-19 08:10:04.6218|Shutting down	Shutting down
2022-08-19 08:10:03.6061|dd03	dd03
2022-08-19 08:10:02.5905|fff	fff
2022-08-19 08:10:01.0593|**Starting**	**Starting**
2022-08-19 08:10:08.6843|**Starting**	**Starting**
2022-08-19 08:10:07.6686|ddd07	ddd07
2022-08-19 08:10:06.6374|fffff06	fffff06
2022-08-19 08:10:05.6218|**Starting**	**Starting**
2022-08-19 08:10:12.5905|fff12	fff12
2022-08-19 08:10:11.0593|**Starting**	**Starting**
2022-08-19 08:10:10.1530|vv10	vv10
2022-08-19 08:10:09.1530|aa09	aa09
2022-08-19 08:10:16.6374|fffff16	fffff16
2022-08-19 08:10:15.6218|**Starting**	**Starting**
2022-08-19 08:10:14.6218|Shutting down	Shutting down
2022-08-19 08:10:13.6061|**Starting**	**Starting**
2022-08-19 08:10:19.15|aa19	aa19
2022-08-19 08:10:18.6843|**Starting**	**Starting**
2022-08-19 08:10:17.6686|ddd17	ddd17
2022-08-19 08:10:20.160|vv20	vv20

[ITWhisperer]

| rex field=logs "\|(?<msg>.+)$"
| stats sum(eval(case(msg=="**Starting**",1,msg=="Shutting down",-1))) as bad count(eval(case(msg=="**Starting**",1))) as starts
| eval good=starts-bad