Splunk Search

Strcat and lookups

mcwomble
Path Finder

I have a query regarding the use of the strcat functionality. The following search is used to generate and alarm condition.

index="ft" ftp | stats  count(eval(status="failed")) as fail_cnt   count(eval(status="success")) as success_cnt by user | strcat "[OPS:FTP:CRITICAL]{NODE:MON1}SFTP Connectivity " user host "  Please raise incident with userdescription" "userdetails ALARM_DESCRIPTION | eval CLEAR=case(success_cnt>0, "1")

It works fine except that the userdetails and userdescription within the strcat argument will not populate. Userdetails and userdescription are lookups from a file (using the user field) which are valid and will populate if defined in a table i.e

| table user success_cnt failed_cnt userdetails userdescription

Any help on this would be appreciated.

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It looks to me like you have mismatched " (quote) marks, but maybe that was just transcribed wrong. Use the eval + or . operators instead of strcat:

... | eval ALARM_DESCRIPTION = "String1" + user + host + " xyz" | ...

gkanapathy
Splunk Employee
Splunk Employee

That is as designed. stats only outputs field specifically computed, and the split-by fields. You should either run the lookup again, or use first(fieldname) as fieldname in stats.

0 Karma

mcwomble
Path Finder

The problem here seems to be that no fields are passed on after the stats command.

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...