Splunk Search

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

nagarjuna280
Communicator

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

Tags (2)
0 Karma
1 Solution

gokadroid
Motivator

Since there is no sample data given, assuming you have data as below where string status=<singleDigit> can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit> phrase occurs same number of times within each event):

aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0

Then how about trying this one:

your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field

Sample snapshot:

alt text

View solution in original post

gokadroid
Motivator

Since there is no sample data given, assuming you have data as below where string status=<singleDigit> can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit> phrase occurs same number of times within each event):

aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0

Then how about trying this one:

your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field

Sample snapshot:

alt text

jpass
Contributor

This might work. Use rex command to match status values and create a single multivalue field. Then use eventstats to sum the values of your multivalue field. If the sum of status = 0, set a new_field to "OK". Otherwise, set new_field to "FAILURE". In the search below you can disregard the 'makeresults' and 'eval _raw =' commands. I just add those to generate an example event like yours that I can use. You want REX & EVENTSTATS

| makeresults | EVAL _raw = "status=0 status=0 status=0" | REX max_match=0 field=_raw "status=(?P<status>[0-9])" | EVENTSTATS sum(status) AS status_sum | EVAL new_field=IF(status_sum==0,"OK","FAILURE")
0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...