Splunk Search

Comparing multiple values for a result

jerinvarghese
Communicator

HI All,

need your help in below query. I use below query to get below output.

Query : 

index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm


Output: 

nodelabel Alarm Time Downtime Status count
CMDLA 10.207.31.222 2020-07-13 15:18:55 00:03:00 UP 2
NGQIT 10.201.68.17 2020-07-13 15:06:35 00:15:19 DOWN 6
EGCAI 158.29.241.86 2020-07-13 14:48:33 00:33:21 UP 2
MXMXC 10.253.208.70 2020-07-12 14:48:03 1+00:33:51 UP 1

Problem : 

I want only output for below conditions.

  > All DOWN must show.
  > UP with only greater than 2 must be shows.
Please help me with the comparing search for this condition.

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Please explain your requirements further as "all DOWN" and "UP greater than 2" seem contradictory.

The latter is accomplished using where after stats.

 

index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm
| where (Status="UP" AND count > 2)

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please explain your requirements further as "all DOWN" and "UP greater than 2" seem contradictory.

The latter is accomplished using where after stats.

 

index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm
| where (Status="UP" AND count > 2)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

jerinvarghese
Communicator

| where ((Status="UP" AND count > 2) OR Status="DOWN")

 

the above command worked. Thanks, your one liner help me think of this way. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click an "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...