I have one server with 24 jvms.I need to write query for jvm down .I tried using inputlookup?

[karthi2809]

I have one server with 24 jvms.I need to write query for jvm down .I tried using inputlookup?

|inputlookup sample.csv |eval count=0| table JVMName count | append [search index=was source="/xx.log" NOT F5App |rex field=source "/ws/(?.)/http/access.log"| stats count by JVMName ]| stats sum(count) by JVMName | where count = 0

But i am not getting any alert?

[kamlesh_vaghela]

Hi Karthi2809,

As I understand your issue, what you want is the count of only those JVMName which are defined in the lookup file.

As per given eg. if lookup file contains "JVMName" comma separated, then your CSV should be like this:

sample.csv
------------------------
JVMName
"node1,node2,node24"

lookup file should NOT like

sample.csv
------------------------
JVMName
node1,node2,node24 // It will consider only the first value "node1"

With this lookup file the search like this :

search index=was source="/xx.log" [|inputlookup sample.csv | eval JVMName=split(JVMName,",") | mvexpand JVMName | return 24 JVMName] NOT F5App | rex field=source "/ws/(?.)/http/access.log"| stats count by JVMName

==========================================================================================

In the case of lookup file, I suggest that keep JVMName one by one in a row, like:

sample.csv
------------------------
JVMName
node1
node2
node24

With this lookup file the search like this :

search index=was source="/xx.log" [|inputlookup sample.csv |  return 24 JVMName ] NOT F5App | rex field=source "/ws/(?.)/http/access.log"| stats count by JVMName

Here, I have used return command to pass value up from subsearch.

I hope this will help you.

Thanks
Kamlesh

[kamlesh_vaghela]

Hi Karthi2809,

Are you getting expected result from below search?

index=was source="/xx.log" NOT F5App | rex field=source "/ws/(?.)/http/access.log"

| stats count by JVMName

AND

Can you please provide information regarding sample.csv?

Thanks
Kamlesh

[karthi2809]

in sample.csv i added jvm names

eg: node1,node2......,node24

[koshyk]

what is sample.csv? can u please paste some raw data from index=was source="xx.log" ?