Splunk Search

Strcat and lookups

mcwomble
Path Finder

I have a query regarding the use of the strcat functionality. The following search is used to generate and alarm condition.

index="ft" ftp | stats  count(eval(status="failed")) as fail_cnt   count(eval(status="success")) as success_cnt by user | strcat "[OPS:FTP:CRITICAL]{NODE:MON1}SFTP Connectivity " user host "  Please raise incident with userdescription" "userdetails ALARM_DESCRIPTION | eval CLEAR=case(success_cnt>0, "1")

It works fine except that the userdetails and userdescription within the strcat argument will not populate. Userdetails and userdescription are lookups from a file (using the user field) which are valid and will populate if defined in a table i.e

| table user success_cnt failed_cnt userdetails userdescription

Any help on this would be appreciated.

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It looks to me like you have mismatched " (quote) marks, but maybe that was just transcribed wrong. Use the eval + or . operators instead of strcat:

... | eval ALARM_DESCRIPTION = "String1" + user + host + " xyz" | ...

gkanapathy
Splunk Employee
Splunk Employee

That is as designed. stats only outputs field specifically computed, and the split-by fields. You should either run the lookup again, or use first(fieldname) as fieldname in stats.

0 Karma

mcwomble
Path Finder

The problem here seems to be that no fields are passed on after the stats command.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...