Count string value over 7 days

[davidcraven02]

I need to display the LastBackupStatus of all servers over the last 7 days. (The values of this field are only Success or Failure)

index=netbackup source=otl_nb_allpolicies client=*nas* 
        | dedup client
        | rex field=client "^(?<machine>[^\.]+)\.?.*" 
        | eval machine=lower(machine) 
        | dedup machine, LastBackupStatus
        | table machine ]
        | fillnull value="NoBackUp", LastBackupStatus

I require a field called "IsBackedUp" added which determines if the server is backed up, based on the last 7 days. If the LastBackupStatus has not been successful in the last 7 days then "IsBackedUp" should be No otherwise set to Yes.

[mayurr98 · Accepted solution]

Try this assuming that machine is extracted properly!

index=netbackup source=otl_nb_allpolicies client=*nas* earliest=-7d@h latest=now
| rex field=client "^(?<machine>[^\.]+)\.?.*" 
| eval machine=lower(machine) 
| eval IsBackedUp=if(LastBackupStatus="Success","Yes","No") 
| stats values(IsBackedUp) as "Is Backed Up?" by machine

Let me know if this helps you!

[maciep]

I think you can use stats here. Something like this (untested)

index=netbackup source=otl_nb_allpolicies client=*nas* 
| eval machine = lower(mvindex(split(client,"."),0))
| stats values(LastBackupStatus) as LastBackupStatus by machine
| eval IsBackUp = if(match(LastBackupStatus,"Success"),true,false)

Not sure if meant that every backup had to be successful or just one, but the search above assumes the latter. If the former, then you an change the logic to match Failure, false, true.

[somesoni2]

I believe there is an additional square bracket in 2nd last line.

If you just want to add a new field IsBackedUp based on LastBackupStatus field value, you can just add following to your current search

your current search | eval IsBackedUp=if(LastBackupStatus="Success","Yes","No")