Splunk Search

IF Statement customized EVAL

jerinvarghese
Communicator

Hi All,

need help in my query, formatting an IF statement.

My Code: 

 

 

 

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time

 

 

 

 

My Output: 

sitecodenodelabelStatusTime
ABMARABMLANCCO1Up1/23/2021 14:35
ABMARABMLANCUA1Up1/23/2021 8:26
ABMARABMLANCUA2Up1/23/2021 8:25
ABMARABMWANRTC1Up1/23/2021 8:25
ABMARABMLANCUA3Up1/23/2021 8:25
ABMARABMLANCUA4Up1/23/2021 8:25
ABMARABMAPNOPT1Up1/19/2021 13:37
ZBQBRZBQLANCUA1Up1/19/2021 13:37

 

Above table am getting from my code.

Requirement : 

I want to list down all devices from that sitecode which have any of these name ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*") these keyword in nodelabel. rest all site code should be removed from the list.

 

In my output. Am having ABM site which matches any of that Keyword and that to be displayed, where as ZBQ doesnt have any of that keyword devices in the list, so it should be removed.

like and IF ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*")  any of this present in device names, then the complete list to be displayed. 

 

Labels (6)
0 Karma

jerinvarghese
Communicator

This is filtering only devices which have "WANRTC|LANCCO|WLNWLC|APNINT". rest all devices from that site removed. I want other devices also from that site including the above one.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

alright,

Try

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time
| eventstats values(eval(if(match(nodelabel,"WANRTC|LANCCO|WLNWLC|APNINT"),1,null()))) as isPresent by app
| where isPresent == 1

 

Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Does this help?

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time
| where match(nodelabel,"WANRTC|LANCCO|WLNWLC|APNINT")

 

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Where can we set the script (host=CSG196) so can we deploy the script in host?

Hi&nbsp; We face a challenge We have created one alert in which we are monitoring one of the windows service ...

Cannot push config from deployer to search head cluster

Hello,I recently upgraded our deployer/deployment server from 8.1.6 to version 9.0 and when I try to push ...

Clear text password in command line

mogod command line argument having clear text password like "--sslPEMKeyPassword=password"how to avoid clear ...