Splunk Search

How to use eval to fulfill the below requirement

akashghonge
New Member

Hi,
I am preparing a dashboard where i can show whether the devices are sending logs or not.
In some region device will send logs to 2 server and in some it will send only to 1 server.
Below is the sample file
1.1.1.1 UKPRI LogSending
2.2.2.2 UKPRI LogNotSending
3.3.3.3 UKPRI LogNotSending
1.1.1.1 UKSEC LogSending
2.2.2.2 UKSEC LogSending
3.3.3.3 UKSEC LogNotSending
4.4.4.4 USPRI LogSending
7.7.7.7 USPRI LogNotSending

Now i want the show which all devices are sending logs and which are not sending (Device 2.2.2.2 is sending log to primary and not sending to secondary, it should be show as sending logs) in stats form.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults|eval raw="1.1.1.1 UKPRI LogSending::2.2.2.2 UKPRI LogNotSending::3.3.3.3 UKPRI LogNotSending::1.1.1.1 UKSEC LogSending::2.2.2.2 UKSEC LogSending::3.3.3.3 UKSEC LogNotSending::4.4.4.4 USPRI LogSending::7.7.7.7 USPRI LogNotSending"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| fields - _time
| rex "^(?<host>\S+)\s+(?<destination>\S+)\s+(?<status>.*)$"

| rename COMMENT AS "Everything above generates event data; everything below is your solution"

| dedup destination host status
| sort 0 destination
| stats list(destination) AS destination list(status) AS status BY host
0 Karma

cmerriman
Super Champion

You could try something like:

|stats values(isSent) as isSent dc(server) as numServers by device |eval logSent=if(like(isSent,"%LogSending%"),1,0)

You might need to add |mvcombine isSent after the stats to make it one line.

isSent is the field name I used for LogSending, server for the server and device for device.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...