Splunk Search

add time constraint for web site avilability check condition

riqbal47010
Path Finder

Referring below query:

index=f5
| rex field=headers "Host: (?<host_url>[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3})" 
| eval portal=if(cidrmatch("10.x0x.0.0/16",dest) OR cidrmatch("10.A0A.0.0/16",dest) ,"External_Portal","Internal_Portal") 
| stats count(eval(status="200")) AS "ok_status", count(eval(status="404" OR status="50*")) as "not_ok_status" by dest,host_url 
**| eval site_status = if("ok_status" < "not_ok_status" , "site_unavailable" , "site_available")** 
| search host_url="www.*.xxx.xx" | fields + dest host_url site_status

================================================
| eval site_status = if("ok_status" < "not_ok_status" , "site_unavailable" , "site_available")

At this stage I want to put the time constraint that if within 5 minutes, if("ok_status" < "not_ok_status") then the site is unavailable.

Tags (1)
0 Karma

to4kawa
Ultra Champion
index=f5 sourcetype=your_sourcetype "www.*" dest="10.x0x.*"
| rex field=headers "Host: (?<host_url>[^:]+?)" 
| stats count(eval(status="200")) AS ok_status, count(eval(status="404" OR status="50*")) as not_ok_status by dest,host_url 
| fields dest host_url ok_status not_ok_status
| eval site_status = if(ok_status < not_ok_status , "site_unavailable" , "site_available")

I modified it in various ways.how about this?

0 Karma

riqbal47010
Path Finder

Further to above I update the query as below:
index=f5
| rex field=headers "Host: (?[a-zA-Z0-9-.]+.[a-zA-Z]{2,3})"
| eval portal=if(cidrmatch("10.x0x.0.0/16",dest) OR cidrmatch("10.a0a.0.0/16",dest) ,"External_Portal","Internal_Portal") | search host_url="www.*.xx.xx" portal="External_Portal"
[ search index=f5 earliest=-5m latest=now
| rex field=headers "Host: (?[a-zA-Z0-9-.]+.[a-zA-Z]{2,3})"
| stats count(eval(status="200")) AS "ok_status", count(eval(status="404" OR status="50*")) as "not_ok_status" by dest,host_url
| eval site_status = if("ok_status" < "not_ok_status" , "site_unavailable" , "site_available")
| return site_status]
| fields site_status,dest,host_url

but no results...?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...