Splunk Search

Dynamically analyze fields?

sf_user_199
Path Finder

I have some data that looks like this:

priority=INFO thread= location= line= field1=OK,field2=OK,field3=OK....field45=OK

What I need to do is analyze field1 through field45 (the number may change) to see if they all equal 'OK'. If not 'OK' then alert. The field names do not all start with the same thing (so no field*).

I can, however, do something like this in the search:

| rex "(?i)line=[\d]\w(?P.*)" | fields host,kv_pairs_to_check| makemv kv_pairs_to_check delim=","

This is kinda giving me the data I want, but not really, and I haven't been able to figure out how to check every kv pair if the value is 'OK' for all of them.

Tags (2)
1 Solution

fk319
Builder

how about instead of putting them in a seperate field, use the same field.?


at the moment I am not sure, but if you know the total and the number of OK's are not the same then error, or regex out the OK and report what is left over?


Probably not very helpfull, but maybe someone else can expand on this idea...

View solution in original post

0 Karma

fk319
Builder

how about instead of putting them in a seperate field, use the same field.?


at the moment I am not sure, but if you know the total and the number of OK's are not the same then error, or regex out the OK and report what is left over?


Probably not very helpfull, but maybe someone else can expand on this idea...

0 Karma

sf_user_199
Path Finder

I won't know the exact numbers, so counting is out. Looking for =[^O] is a great idea, however. I'm going to play around with that...

0 Karma

fk319
Builder

ok, I was think about this a different way, could you take your list of fields as just one field and search to see if you have a regex of '=[^O]' ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...