Comparing multiple values for a result

[jerinvarghese]

HI All,

need your help in below query. I use below query to get below output.

Query : 

index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm

Output: 

nodelabel Alarm Time Downtime Status count
CMDLA 10.207.31.222 2020-07-13 15:18:55 00:03:00 UP 2
NGQIT 10.201.68.17 2020-07-13 15:06:35 00:15:19 DOWN 6
EGCAI 158.29.241.86 2020-07-13 14:48:33 00:33:21 UP 2
MXMXC 10.253.208.70 2020-07-12 14:48:03 1+00:33:51 UP 1

Problem : 

I want only output for below conditions.

  > All DOWN must show.
  > UP with only greater than 2 must be shows.
Please help me with the comparing search for this condition.

[richgalloway · Accepted solution]

Please explain your requirements further as "all DOWN" and "UP greater than 2" seem contradictory.

The latter is accomplished using where after stats.

index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm
| where (Status="UP" AND count > 2)

[jerinvarghese]

| where ((Status="UP" AND count > 2) OR Status="DOWN")

the above command worked. Thanks, your one liner help me think of this way. 

[richgalloway]

If your problem is resolved, then please click an "Accept as Solution" button to help future readers.