Splunk Search

Dynamically analyze fields?

sf_user_199
Path Finder

I have some data that looks like this:

priority=INFO thread= location= line= field1=OK,field2=OK,field3=OK....field45=OK

What I need to do is analyze field1 through field45 (the number may change) to see if they all equal 'OK'. If not 'OK' then alert. The field names do not all start with the same thing (so no field*).

I can, however, do something like this in the search:

| rex "(?i)line=[\d]\w(?P.*)" | fields host,kv_pairs_to_check| makemv kv_pairs_to_check delim=","

This is kinda giving me the data I want, but not really, and I haven't been able to figure out how to check every kv pair if the value is 'OK' for all of them.

Tags (2)
1 Solution

fk319
Builder

how about instead of putting them in a seperate field, use the same field.?


at the moment I am not sure, but if you know the total and the number of OK's are not the same then error, or regex out the OK and report what is left over?


Probably not very helpfull, but maybe someone else can expand on this idea...

View solution in original post

0 Karma

fk319
Builder

how about instead of putting them in a seperate field, use the same field.?


at the moment I am not sure, but if you know the total and the number of OK's are not the same then error, or regex out the OK and report what is left over?


Probably not very helpfull, but maybe someone else can expand on this idea...

0 Karma

sf_user_199
Path Finder

I won't know the exact numbers, so counting is out. Looking for =[^O] is a great idea, however. I'm going to play around with that...

0 Karma

fk319
Builder

ok, I was think about this a different way, could you take your list of fields as just one field and search to see if you have a regex of '=[^O]' ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...