Splunk Search

Duration Filter help

jerinvarghese
Communicator

Hi All,

Need help in the Duration filter.

Code: 

 

index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"

| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"

| table nodelabel, Status, Downtime, Time

 

 

Sample output: 

nodelabelStatusDowntimeTime
USBTNBTECEDownNotify0:12:0212/9/2020 2:36
USJOLWLCDownNotify1:31:2112/9/2020 2:17
USMBPDownNotify2:08:2512/9/2020 1:39

 

Requirement is.: 

Filter/remove all those values less than 1 hr Downtime.

Tried all possibilities  "| where duration >3600"  but no output coming when giving this. Please suggest a solution. 

Labels (4)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

@jerinvarghese , you should filter the Downtime values before formatting like below;

index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"

| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| where Downtime > 3600
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"

| table nodelabel, Status, Downtime, Time
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

@jerinvarghese , you should filter the Downtime values before formatting like below;

index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"

| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| where Downtime > 3600
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"

| table nodelabel, Status, Downtime, Time
If this reply helps you an upvote is appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>