Splunk Search

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

nagarjuna280
Communicator

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

Tags (2)
0 Karma
1 Solution

gokadroid
Motivator

Since there is no sample data given, assuming you have data as below where string status=<singleDigit> can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit> phrase occurs same number of times within each event):

aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0

Then how about trying this one:

your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field

Sample snapshot:

alt text

View solution in original post

gokadroid
Motivator

Since there is no sample data given, assuming you have data as below where string status=<singleDigit> can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit> phrase occurs same number of times within each event):

aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0

Then how about trying this one:

your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field

Sample snapshot:

alt text

jpass
Contributor

This might work. Use rex command to match status values and create a single multivalue field. Then use eventstats to sum the values of your multivalue field. If the sum of status = 0, set a new_field to "OK". Otherwise, set new_field to "FAILURE". In the search below you can disregard the 'makeresults' and 'eval _raw =' commands. I just add those to generate an example event like yours that I can use. You want REX & EVENTSTATS

| makeresults | EVAL _raw = "status=0 status=0 status=0" | REX max_match=0 field=_raw "status=(?P<status>[0-9])" | EVENTSTATS sum(status) AS status_sum | EVAL new_field=IF(status_sum==0,"OK","FAILURE")
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...