Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Splunk Search
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to edit my search to display "VPN UP" or "...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jd
Explorer
03-25-2015
03:27 AM
Hy,
I'm searching to monitor my VPN. I found a way to search the latest values of my field "vpntype" in the last 2 minutes. If my vpntype =ipsec-static, then my vpn is UP. If it is blank, my VPN is down :
host="172.10.0.28" vpntype="ipsec-static" | stats latest(vpntype)
Can i have a way to display "VPN UP" instead of the vnptype values ?
Thanks.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Patient
Path Finder
03-25-2015
03:55 AM
Hi,
try with:
host="172.10.0.28" vpntype="ipsec-static" | stats latest(vpntype) as val|eval latest_vpntype=if(vpntype=="ipsec-static", "VPN UP", val)| table latest_vpntype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Patient
Path Finder
03-25-2015
03:55 AM
Hi,
try with:
host="172.10.0.28" vpntype="ipsec-static" | stats latest(vpntype) as val|eval latest_vpntype=if(vpntype=="ipsec-static", "VPN UP", val)| table latest_vpntype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jd
Explorer
03-25-2015
03:56 AM
Great !! Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Patient
Path Finder
03-25-2015
04:06 AM
Thank for your vote.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
satishsdange
Builder
03-25-2015
03:46 AM
Hi -
Please try below -
your base search | eval VPN_Status=case(vpntype==ipsec-static, "VPN UP", vpntype!=ipsec-static, "VPN DOWN")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jd
Explorer
03-25-2015
03:53 AM
Hy,
Thanks. I try it but don't works. my visualisation is "ipsec-static".
Get Updates on the Splunk Community!
Enterprise Security Content Update (ESCU) | New Releases
In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
(This is the first of a series of 2 blogs).
Splunk Enterprise Security is a fantastic tool that offers robust ...
Index This | What are the 12 Days of Splunk-mas?
December 2024 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with another ...
