Splunk Search

see results of a rex command

owie6466
Explorer

i have this rex code to extract the string from an event field:

| rex "(?\d{1,2})\s+hours?\s+ago"
| eval process=case(Time<4, "Process Up", true(), "Process down")

this is the event field:
Event
0 minutes ago, vmkid-p4rbdb03.lm.lmig.com, windows 6.3.9600.
1 minute ago, vmpid-h4eip001.lm.lmig.com, windows 6.3.9600.

What i wanted to do is extract the 1st string w/out the minute(s) ago and use an argument to check if this is less than 4, if it is i want to label it "Process up" and if not, it should be "Process down"

my code above is not working as it's marking all servers with less than 4 as Process down. that's why i wanted to see the results for the rex command

can you help me?

thank you!

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Try this run anywhere search:

| makeresults 
| eval data="5 minutes ago, vmkid-p4rbdb03.lm.lmig.com, windows 6.3.9600.:1 minute ago, vmpid-h4eip001.lm.lmig.com, windows 6.3.9600." 
| makemv data delim=":" 
| mvexpand data 
| rex field=data "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")

On your prod data you should try:

.. | rex field=_raw "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")

View solution in original post

0 Karma

mayurr98
Super Champion

Try this run anywhere search:

| makeresults 
| eval data="5 minutes ago, vmkid-p4rbdb03.lm.lmig.com, windows 6.3.9600.:1 minute ago, vmpid-h4eip001.lm.lmig.com, windows 6.3.9600." 
| makemv data delim=":" 
| mvexpand data 
| rex field=data "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")

On your prod data you should try:

.. | rex field=_raw "(?<Time>\d{1,2})\s+(minute|hour)s?\s+ago" 
| eval process=if(Time<4,"Process Up","Process Down")
0 Karma

owie6466
Explorer

thank you so much!

0 Karma

owie6466
Explorer

is there a way to make the data generic? i have multiple search results.

0 Karma

mayurr98
Super Champion

I didn't get you. could you pls elaborate ?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...