HI All,
need your help in below query. I use below query to get below output.
Query :
index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm
Output:
nodelabel Alarm Time Downtime Status count
CMDLA 10.207.31.222 2020-07-13 15:18:55 00:03:00 UP 2
NGQIT 10.201.68.17 2020-07-13 15:06:35 00:15:19 DOWN 6
EGCAI 158.29.241.86 2020-07-13 14:48:33 00:33:21 UP 2
MXMXC 10.253.208.70 2020-07-12 14:48:03 1+00:33:51 UP 1
Problem :
I want only output for below conditions.
> All DOWN must show.
> UP with only greater than 2 must be shows.
Please help me with the comparing search for this condition.
Please explain your requirements further as "all DOWN" and "UP greater than 2" seem contradictory.
The latter is accomplished using where after stats.
index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm
| where (Status="UP" AND count > 2)
Please explain your requirements further as "all DOWN" and "UP greater than 2" seem contradictory.
The latter is accomplished using where after stats.
index=nw_syslog
| rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)"
| stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm
| where (Status="UP" AND count > 2)
| where ((Status="UP" AND count > 2) OR Status="DOWN")
the above command worked. Thanks, your one liner help me think of this way.
If your problem is resolved, then please click an "Accept as Solution" button to help future readers.