Splunk Search

If atleast one processor is up i need to consider device is online

Veeru
Path Finder

Hello

Greetings!

i have data in the following way

Device   Processor  status

01             Splunkd        Running

01               Sql                 Stopped

01                Python        Stopped

02          Spluknd.          Stopped

In the above output for a device if state is running of atleast on processor need to consider it as online otherwise offline can you please help me with query.

 

 

Thank you in advance

Happy splunking!

Labels (3)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The simplest might be regex.

| regex "\b\w+\s+\w+\s+Running\b"

Or, if you want to be more structural, you could do multikv to extract fields. This would be more flexible if you want additional data for later.

| rex mode=sed "s/ +/,/g"
| multikv forceheader=1
| where status == "Running"

 

Tags (2)
0 Karma

Veeru
Path Finder

@yuanliu 

Thanks for reply

sorry my bad It's actually output.Considering the down output  have Device 01 and 02 with Processors and Status
   For device atleast one processor status is in running state should consider as online otherwise offline.

in device 01 we have 3 processors out of 2 are in status running.as per condition if one is in running state we need take 01 as online.
Need query for this

DeviceProcessorstatus
01splunkdrunning
01sqlstopped
01pythonrunning
02splunkdstopped
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I'm not sure if I understand this.  If you already have all the fields, a simple filter like '| where status == "Running"' should suffice, e.g.,

 

| where status == "Running"
| dedup Device status

 

Your sample data will give

DeviceProcessorstatus
01SqlRunning

 

Or is the requirement to output a string "online" or "offline" for each device?  To do that 

 

| stats values(status) by Device
| eval online_or_not = if('values(status)' == "Running", "online", "offline")

 

With this, your sample data will give

Device
values(status)
online_or_not
01
Running
Stopped
online
02Stoppedoffline
0 Karma

Veeru
Path Finder

@yuanliu 

Thanks for the reply 

 

Let me try and update you.

 

Happy splunking!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...