Splunk Search

Search doesn't show results if for the same node are present two type of alarms

ngerosa
Path Finder

Hello,
I have a query that extract some type of alarms divided by NODE.
These are the columns of the query:

_time ALARM NODE

If for the same NODE is present ALARM = "FAN-IS" and ALARM="SRMISS" I don't want to show the two rows of the two alarms.

Example:

2017-07-11 13:00:25 FAN-IS MILAN
2017-07-11 13:01:42 SRMISS MILAN
2017-07-11 14:10:12 CARD-PROBLEM ROME

I want to show only:

2017-07-11 14:10:12 CARD-PROBLEM ROME

Any ideas?

Thanks!

Tags (1)
0 Karma

somesoni2
Revered Legend

Try this

Your query giving fields _time ALARM NODE
| eventstats values(ALARM) as alarms by NODE
| where NOT (isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS"))) 

Updated answer

 Your query giving fields _time ALARM NODE
  | eventstats values(ALARM) as alarms by NODE
  | eval shouldKeep=if(isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS")),"No","Yes")
  | where shouldKeep="Yes"

ngerosa
Path Finder

Hi somesoni2,
I tried but it didn't work.
The following is the results of the search:

ALARM NODE _time alarms
SRMISS MILAN 2017-06-21 13:08:18.0 FAN-IS
SRMISS

0 Karma

somesoni2
Revered Legend

Try this

Your query giving fields _time ALARM NODE
 | eventstats values(ALARM) as alarms by NODE
 | where isnull(mvfind(alarms,"FAN-IS")) AND isnull(mvfind(alarms,"SRMISS"))
| fields - alarms
0 Karma

ngerosa
Path Finder

It doesn't work.
The search include all alarms (FAN-IS and SRMISS)

0 Karma

somesoni2
Revered Legend

How about this?

Your query giving fields _time ALARM NODE
 | eventstats values(ALARM) as alarms by NODE
 | eval shouldKeep=if(isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS")),"No","Yes")
 | where shouldKeep="Yes"

If this doesnt work then remove last where clause and see if the values are coming per your requirement (manual check).

0 Karma

ngerosa
Path Finder

It works!!
Thank you very much!
If you modify the answer I'll accept!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...