conditional search via based on total count

[corehan]

Hello,

Here is my search output. I want see , if Count of "Down" > "Up" criteria. Than I can  understand, interface is stil down!

index=syslog field7="nw_ra_m016_02.34bhsr" "%%01ISIS" AdjState="1" OR AdjState="3" OR AdjState="Down" OR AdjState="Up" |stats count by field7,IfName,AdjState

splunkpost.png

Field7 which is host

IfName : Interface name

AdjState : Protocol state which is IS-IS 

[bowesmana]

@corehan 

If you want a new search to calculate this, then 

index=syslog field7="nw_ra_m016_02.34bhsr" "%%01ISIS" AdjState="1" OR AdjState="3" OR AdjState="Down" OR AdjState="Up" 
| stats sum(eval(if(AdjState="Down",1,0))) as Down sum(eval(if(AdjState="Up",1,0))) as Up by field7 IfName
| eval CurrentState="Interface ".if(Up>Down, "Up", "Down")

and that will give you 'Interface Up' or 'Interface Down'. However, is this a reliable indicator? If the values are the same, then you need to know the starting state of the interface at the start of your search interval, as equal counts will indicate that the interface is in the same state that it was at the start of your search interval.

If you want to add a new column to the existing table you have then do this

| eventstats max(eval(if(AdjState="Down",count,0))) as Down max(eval(if(AdjState="Up",count,0))) as Up by field7 IfName
| eval CurrentState="Interface ".if(Up>Down, "Up", "Down")
| fields - Up Down

Hope this helps

[corehan]

Thank you for interesting.

Actually, if count of down > up, i want print like warning message. 

[bowesmana · Accepted solution]

Print? I assume you want this piece of information somewhere on the dashboard - decide where and what you want to show then craft the search accordingly, based on the examples shown. Those examples should give you enough to either create a new panel or add to the existing.