Splunk Search

How to use eval to fulfill the below requirement

New Member

I am preparing a dashboard where i can show whether the devices are sending logs or not.
In some region device will send logs to 2 server and in some it will send only to 1 server.
Below is the sample file UKPRI LogSending UKPRI LogNotSending UKPRI LogNotSending UKSEC LogSending UKSEC LogSending UKSEC LogNotSending USPRI LogSending USPRI LogNotSending

Now i want the show which all devices are sending logs and which are not sending (Device is sending log to primary and not sending to secondary, it should be show as sending logs) in stats form.

Tags (1)
0 Karma

Esteemed Legend

Like this:

|makeresults|eval raw=" UKPRI LogSending:: UKPRI LogNotSending:: UKPRI LogNotSending:: UKSEC LogSending:: UKSEC LogSending:: UKSEC LogNotSending:: USPRI LogSending:: USPRI LogNotSending"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| fields - _time
| rex "^(?<host>\S+)\s+(?<destination>\S+)\s+(?<status>.*)$"

| rename COMMENT AS "Everything above generates event data; everything below is your solution"

| dedup destination host status
| sort 0 destination
| stats list(destination) AS destination list(status) AS status BY host
0 Karma

Super Champion

You could try something like:

|stats values(isSent) as isSent dc(server) as numServers by device |eval logSent=if(like(isSent,"%LogSending%"),1,0)

You might need to add |mvcombine isSent after the stats to make it one line.

isSent is the field name I used for LogSending, server for the server and device for device.

Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...