Splunk Search

Col operation

mandyst
Engager

Hi everyone,

Is it possible to achieve this: My search has resulted in four columns

Column1       Column2          Column3         Column4
------                 -------                   -------                -------
Type1             Source1            OK(status)      Item1
Type2             Source2            OK(status)      Item2
Type3             Source3            BAD(status)   Item3
Type4             Source4            OK(status)      Item4
Type5             Source5            BAD(status)    Item5
Type6             Source6            BAD(status)    Item6


I wish to send an email periodically with this text:

At this time, Items: Item1, Item2, Item4 are OK, and Item3, Item5, Item6 are BAD.

Is it possible to filter Items based on Column3 and get all fields in a single line in order to put them in a message which will also be part of the resulting query?

If it is not possible to make both cases - OK and BAD in the same line, it would be nice to have only one working.

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mandyst 

Can you please try this?

YOUR_SEARCH
| eval Column3=replace(Column3,"\(status\)","") 
| stats  delim="," values(Column4) as Column4 by Column3 | mvcombine Column4
| transpose header_field=Column3
| eval OK = if(isnull(OK),"","Items: ".OK." are OK")
| eval BAD = if(isnull(BAD),"",BAD." are BAD")
| eval message="At this time,".OK." and ".BAD." are BAD."

My Sample Search :

| makeresults 
| eval _raw="Column1,Column2,Column3,Column4
Type1,Source1,OK(status),Item1
Type2,Source2,OK(status),Item2
Type3,Source3,BAD(status),Item3
Type4,Source4,OK(status),Item4
Type5,Source5,BAD(status),Item5
Type6,Source6,BAD(status),Item6" 
| multikv forceheader=1 
| eval Column3=replace(Column3,"\(status\)","") 
| stats  delim="," values(Column4) as Column4 by Column3 | mvcombine Column4
| transpose header_field=Column3
| eval OK = if(isnull(OK),"","Items: ".OK." are OK")
| eval BAD = if(isnull(BAD),"",BAD." are BAD")
| eval message="At this time,".OK." and ".BAD." are BAD."

 

You can change this search as per your requirement.

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mandyst 

Can you please try this?

YOUR_SEARCH
| eval Column3=replace(Column3,"\(status\)","") 
| stats  delim="," values(Column4) as Column4 by Column3 | mvcombine Column4
| transpose header_field=Column3
| eval OK = if(isnull(OK),"","Items: ".OK." are OK")
| eval BAD = if(isnull(BAD),"",BAD." are BAD")
| eval message="At this time,".OK." and ".BAD." are BAD."

My Sample Search :

| makeresults 
| eval _raw="Column1,Column2,Column3,Column4
Type1,Source1,OK(status),Item1
Type2,Source2,OK(status),Item2
Type3,Source3,BAD(status),Item3
Type4,Source4,OK(status),Item4
Type5,Source5,BAD(status),Item5
Type6,Source6,BAD(status),Item6" 
| multikv forceheader=1 
| eval Column3=replace(Column3,"\(status\)","") 
| stats  delim="," values(Column4) as Column4 by Column3 | mvcombine Column4
| transpose header_field=Column3
| eval OK = if(isnull(OK),"","Items: ".OK." are OK")
| eval BAD = if(isnull(BAD),"",BAD." are BAD")
| eval message="At this time,".OK." and ".BAD." are BAD."

 

You can change this search as per your requirement.

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

mandyst
Engager

Thank you @kamlesh_vaghela 

It is perfect

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...