Splunk Search

IF Statement customized EVAL

jerinvarghese
Communicator

Hi All,

need help in my query, formatting an IF statement.

My Code: 

 

 

 

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time

 

 

 

 

My Output: 

sitecodenodelabelStatusTime
ABMARABMLANCCO1Up1/23/2021 14:35
ABMARABMLANCUA1Up1/23/2021 8:26
ABMARABMLANCUA2Up1/23/2021 8:25
ABMARABMWANRTC1Up1/23/2021 8:25
ABMARABMLANCUA3Up1/23/2021 8:25
ABMARABMLANCUA4Up1/23/2021 8:25
ABMARABMAPNOPT1Up1/19/2021 13:37
ZBQBRZBQLANCUA1Up1/19/2021 13:37

 

Above table am getting from my code.

Requirement : 

I want to list down all devices from that sitecode which have any of these name ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*") these keyword in nodelabel. rest all site code should be removed from the list.

 

In my output. Am having ABM site which matches any of that Keyword and that to be displayed, where as ZBQ doesnt have any of that keyword devices in the list, so it should be removed.

like and IF ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*")  any of this present in device names, then the complete list to be displayed. 

 

Labels (6)
0 Karma

jerinvarghese
Communicator

This is filtering only devices which have "WANRTC|LANCCO|WLNWLC|APNINT". rest all devices from that site removed. I want other devices also from that site including the above one.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

alright,

Try

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time
| eventstats values(eval(if(match(nodelabel,"WANRTC|LANCCO|WLNWLC|APNINT"),1,null()))) as isPresent by app
| where isPresent == 1

 

Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Does this help?

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time
| where match(nodelabel,"WANRTC|LANCCO|WLNWLC|APNINT")

 

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...