Splunk Search

How to use eval to fulfill the below requirement

akashghonge
New Member

Hi,
I am preparing a dashboard where i can show whether the devices are sending logs or not.
In some region device will send logs to 2 server and in some it will send only to 1 server.
Below is the sample file
1.1.1.1 UKPRI LogSending
2.2.2.2 UKPRI LogNotSending
3.3.3.3 UKPRI LogNotSending
1.1.1.1 UKSEC LogSending
2.2.2.2 UKSEC LogSending
3.3.3.3 UKSEC LogNotSending
4.4.4.4 USPRI LogSending
7.7.7.7 USPRI LogNotSending

Now i want the show which all devices are sending logs and which are not sending (Device 2.2.2.2 is sending log to primary and not sending to secondary, it should be show as sending logs) in stats form.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults|eval raw="1.1.1.1 UKPRI LogSending::2.2.2.2 UKPRI LogNotSending::3.3.3.3 UKPRI LogNotSending::1.1.1.1 UKSEC LogSending::2.2.2.2 UKSEC LogSending::3.3.3.3 UKSEC LogNotSending::4.4.4.4 USPRI LogSending::7.7.7.7 USPRI LogNotSending"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| fields - _time
| rex "^(?<host>\S+)\s+(?<destination>\S+)\s+(?<status>.*)$"

| rename COMMENT AS "Everything above generates event data; everything below is your solution"

| dedup destination host status
| sort 0 destination
| stats list(destination) AS destination list(status) AS status BY host
0 Karma

cmerriman
Super Champion

You could try something like:

|stats values(isSent) as isSent dc(server) as numServers by device |eval logSent=if(like(isSent,"%LogSending%"),1,0)

You might need to add |mvcombine isSent after the stats to make it one line.

isSent is the field name I used for LogSending, server for the server and device for device.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...