Hi All,
Need help in the Duration filter.
Code:
index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"
| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"
| table nodelabel, Status, Downtime, Time
Sample output:
nodelabel | Status | Downtime | Time |
USBTNBTECE | DownNotify | 0:12:02 | 12/9/2020 2:36 |
USJOLWLC | DownNotify | 1:31:21 | 12/9/2020 2:17 |
USMBP | DownNotify | 2:08:25 | 12/9/2020 1:39 |
Requirement is.:
Filter/remove all those values less than 1 hr Downtime.
Tried all possibilities "| where duration >3600" but no output coming when giving this. Please suggest a solution.
@jerinvarghese , you should filter the Downtime values before formatting like below;
index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"
| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| where Downtime > 3600
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"
| table nodelabel, Status, Downtime, Time
@jerinvarghese , you should filter the Downtime values before formatting like below;
index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"
| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| where Downtime > 3600
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"
| table nodelabel, Status, Downtime, Time