Splunk Search

IF Statement customized EVAL

jerinvarghese
Communicator

Hi All,

need help in my query, formatting an IF statement.

My Code: 

 

 

 

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time

 

 

 

 

My Output: 

sitecodenodelabelStatusTime
ABMARABMLANCCO1Up1/23/2021 14:35
ABMARABMLANCUA1Up1/23/2021 8:26
ABMARABMLANCUA2Up1/23/2021 8:25
ABMARABMWANRTC1Up1/23/2021 8:25
ABMARABMLANCUA3Up1/23/2021 8:25
ABMARABMLANCUA4Up1/23/2021 8:25
ABMARABMAPNOPT1Up1/19/2021 13:37
ZBQBRZBQLANCUA1Up1/19/2021 13:37

 

Above table am getting from my code.

Requirement : 

I want to list down all devices from that sitecode which have any of these name ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*") these keyword in nodelabel. rest all site code should be removed from the list.

 

In my output. Am having ABM site which matches any of that Keyword and that to be displayed, where as ZBQ doesnt have any of that keyword devices in the list, so it should be removed.

like and IF ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*")  any of this present in device names, then the complete list to be displayed. 

 

Labels (6)
0 Karma

jerinvarghese
Communicator

This is filtering only devices which have "WANRTC|LANCCO|WLNWLC|APNINT". rest all devices from that site removed. I want other devices also from that site including the above one.

0 Karma

renjith_nair
Legend

alright,

Try

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time
| eventstats values(eval(if(match(nodelabel,"WANRTC|LANCCO|WLNWLC|APNINT"),1,null()))) as isPresent by app
| where isPresent == 1

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

Does this help?

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table  sitecode, nodelabel, Status,Time
| where match(nodelabel,"WANRTC|LANCCO|WLNWLC|APNINT")

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...