Splunk Search

Matching only part of a string to return a result when different

ssaenger
Path Finder

Hi,

I am streaming results from a Kubernetes cluster and i am monitoring for pod restarts by looking at the name of each pod and reporting when it changes.

I am able to return the pod name, however i am unable to make my match statement work to only return the different pod names.

the pods are named;

prod-K8-1-b5c85b547-26wqn 
prod-K8-2-7c56dc8559-kzpwm 
prod-K8-3-7c7bccf947-4skx2 
prod-K8-4-769bb9d4f5-tmwbz 
...

i have code that returns the pod names over a time frame;

   index=K8 "kubernetes.container_name"=tfs kubernetes.pod_name=prod* earliest=-5m@m latest=@m| stats first(kubernetes.pod_name) as old_pod last(kubernetes.pod_name) as new_pod by kubernetes.pod_name | where old_pod=new_pod

 

kubernetes.pod_name                     old_pod                                                  new_pod

prod-K8-1-b5c85b547-26wqnprod-K8-1-b5c85b547-26wqnprod-K8-1-b5c85b547-26wqn
prod-K8-1-b5c85b547-tdgwgprod-K8-1-b5c85b547-tdgwgprod-K8-1-b5c85b547-tdgwg

 

I think i need to use some regex in my where statement, but i end up getting no results, the above where clause was to show an output.

I would like to get my output table to list the current pod name then have the two different pod names.

any help would be much appreciated.

Labels (2)
0 Karma
1 Solution

gcusello
Legend

Hi @ssaenger,

the result of your search will be always the same because you have the same field in old_pod, now_pod and in the by cluase.

Is there a key to correlate old_pod and new pod?

something like this:

 index=K8 "kubernetes.container_name"=tfs kubernetes.pod_name=prod* earliest=-5m@m latest=@m
| stats first(kubernetes.pod_name) as old_pod last(kubernetes.pod_name) as new_pod by key 
| where old_pod=new_pod

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @ssaenger,

the result of your search will be always the same because you have the same field in old_pod, now_pod and in the by cluase.

Is there a key to correlate old_pod and new pod?

something like this:

 index=K8 "kubernetes.container_name"=tfs kubernetes.pod_name=prod* earliest=-5m@m latest=@m
| stats first(kubernetes.pod_name) as old_pod last(kubernetes.pod_name) as new_pod by key 
| where old_pod=new_pod

Ciao.

Giuseppe

ssaenger
Path Finder

Hi Giuseppe,

yes thanks for that.

i created a new field;

| rex field=kubernetes.pod_name "^(?P<pod>.{14})"

then added pod to the stats by clause, this was the bit I could not see.

Thanks for the pointer.

0 Karma

gcusello
Legend

Hi @ssaenger,

good for you, see next time!

you could also try something like this:

 index=K8 "kubernetes.container_name"=tfs kubernetes.pod_name=prod* earliest=-5m@m latest=@m
| stats dc(kubernetes.pod_name) as pods by pod 
| where pods>1

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...