Splunk Search

How to edit our search to output certain values based on a status field?

splunker9999
Path Finder

Hi,

We have a requirement to write a search:

We have a status(up,down,disabled,enabled),
1.If status is up or enabled, we have given value range of 10 and is OK(Green)
2.If status is down or disabled, we have given a range of 0 and is severe (RED).

Below is our basic search, but it currently only works if status is Up or down. Can someone help in enhancing this search such that we can update for 4 statuses? When Up OR ENABLED, it should be value 10...If Down OR DISABLED, it should be 0 (SEVERE).

index=f5 server1  monitor status | fillnull value="up" F5_TCPStatus | eval status=if(F5_MonitorStatus="up",10,0)|head 1 |appendpipe [ stats count | eval status=10 | where count==0 | fields - count ] | stats values(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=f5 server1  monitor status | head 1| fillnull value="up" F5_TCPStatus | eval status=if(F5_MonitorStatus="up" OR F5_MonitorStatus="enabled",10,0) |appendpipe [ stats count | eval status=10 | where count==0 | fields - count ] | stats values(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

index=f5 server1  monitor status | head 1| fillnull value="up" F5_TCPStatus | eval status=if(F5_MonitorStatus="up" OR F5_MonitorStatus="enabled",10,0) |appendpipe [ stats count | eval status=10 | where count==0 | fields - count ] | stats values(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated

View solution in original post

0 Karma

splunker9999
Path Finder

Thanks....

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!