Splunk Search

How to use eval to fulfill the below requirement

akashghonge
New Member

Hi,
I am preparing a dashboard where i can show whether the devices are sending logs or not.
In some region device will send logs to 2 server and in some it will send only to 1 server.
Below is the sample file
1.1.1.1 UKPRI LogSending
2.2.2.2 UKPRI LogNotSending
3.3.3.3 UKPRI LogNotSending
1.1.1.1 UKSEC LogSending
2.2.2.2 UKSEC LogSending
3.3.3.3 UKSEC LogNotSending
4.4.4.4 USPRI LogSending
7.7.7.7 USPRI LogNotSending

Now i want the show which all devices are sending logs and which are not sending (Device 2.2.2.2 is sending log to primary and not sending to secondary, it should be show as sending logs) in stats form.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults|eval raw="1.1.1.1 UKPRI LogSending::2.2.2.2 UKPRI LogNotSending::3.3.3.3 UKPRI LogNotSending::1.1.1.1 UKSEC LogSending::2.2.2.2 UKSEC LogSending::3.3.3.3 UKSEC LogNotSending::4.4.4.4 USPRI LogSending::7.7.7.7 USPRI LogNotSending"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| fields - _time
| rex "^(?<host>\S+)\s+(?<destination>\S+)\s+(?<status>.*)$"

| rename COMMENT AS "Everything above generates event data; everything below is your solution"

| dedup destination host status
| sort 0 destination
| stats list(destination) AS destination list(status) AS status BY host
0 Karma

cmerriman
Super Champion

You could try something like:

|stats values(isSent) as isSent dc(server) as numServers by device |eval logSent=if(like(isSent,"%LogSending%"),1,0)

You might need to add |mvcombine isSent after the stats to make it one line.

isSent is the field name I used for LogSending, server for the server and device for device.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...