Splunk Search

How to generate a search that will compare list of servers and give the difference in server status?

Path Finder

Whenever server on F5 gets down it shows log like :

Virtual /Common/vs has become unavailable

When server on f5 comes back up :

Virtual /Common/vs has become available

Splunk search to list servers which went down :

(index=* "has become unavailable" | rex "(?Virtual \s*([^\s]*))" | dedup unavailable | table unavailable

Splunk search to list servers which came up :

(index=*  "has become available" | rex "(?Virtual \s*([^\s]*))" | dedup available | table available

Following Splunk searches give me list of virtual server which went down and came up . Now i would like compare list of servers which went down with the servers which came up and give me difference (i.e server names which went down but never came up).
Tried join/append but it doesn't work. Can someone please help!!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this. It takes the most recent status for each server and keeps only those that are still unavailable.

index=foo "has become unavailable" OR "has become available" | rex "Virtual (?<server>[^\s]+) has become (?<status>\w+" | dedup server | where status = "unavailable" | table server status
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this. It takes the most recent status for each server and keeps only those that are still unavailable.

index=foo "has become unavailable" OR "has become available" | rex "Virtual (?<server>[^\s]+) has become (?<status>\w+" | dedup server | where status = "unavailable" | table server status
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Path Finder

Excellent ,it works . I didn't knew that i can use dedup to find latest log as well apart from removing duplicates 😞 .. Thanks for help !!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!