Splunk Search

Need help in 2 stats operator

jerinvarghese
Communicator

Hi All,

need help in using 2 stats operation in one program.

My program:

 

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel 
| table nodelabel,Status,Time
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| table nodelabel,Status,Time, sitecode

 

Output Table : 

nodelabelStatusTimesitecode
AOKWA1Down1/20/2021 20:36KWA
BXTPRDown1/20/2021 20:34TPR
UKHCODown1/20/2021 20:32HCO
AOKWA3Down1/20/2021 20:30KWA
AOKWA2Down1/20/2021 20:29KWA
AOKWA4Down1/20/2021 20:18KWA

 

Here I have KWA 4 times.

Requirement : i need to filter only those sitescodes which are greater than 3 numbers.( all KWA only should be listed in my required output table, ignore all with sitecode count less than 3)

 

Labels (6)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @jerinvarghese ,

Try this:

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| eventstats count by sitecode

| where count > 3
| table nodelabel, Status, Time, sitecode

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

0 Karma

jerinvarghese
Communicator

Hi, that is not giving me the correct value. its calculating the event's previous occurrence count rather than the count of sitecode.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

I've updated my answer please check it.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @jerinvarghese ,

Try this:

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| lookup ONMS_nodes.csv nodelabel OUTPUT sitecode
| eventstats count by sitecode

| where count > 3
| table nodelabel, Status, Time, sitecode

If this reply helps you, an upvote/like would be appreciated.

0 Karma