Thanks for sticking around on this sideview. I ran the troubleshooting code and looks like we're still getting matches passed through to upstream regex (see below). I don't know if I mentioned it, but it is possible for Sync_Status to be NULL or Blank. Status and Failover will NEVER be NULL or blank. I would also assume the times would always match: host Failover Failover_time Sync_Status Sync_Status_time Status Status_time cn1 10/13/2016 16:02 10/13/2016 16:02 cn1 Standalone 10/13/2016 16:02 Standalone 10/13/2016 16:02 sg1 All devices in the device group are in sync 10/13/2016 16:02 All devices in the device group are in sync 10/13/2016 16:02 sg1 In Sync 10/13/2016 16:02 In Sync 10/13/2016 16:02 gb1 All devices in the device group are in sync 10/13/2016 16:02 All devices in the device group are in sync 10/13/2016 16:02 gb1 In Sync 10/13/2016 16:02 In Sync 10/13/2016 16:02 in1 10/13/2016 16:02 10/13/2016 16:02 in1 Standalone 10/13/2016 16:02 Standalone 10/13/2016 16:02 sg2 All devices in the device group are in sync 10/13/2016 16:02 All devices in the device group are in sync 10/13/2016 16:02 sg2 In Sync 10/13/2016 16:02 In Sync 10/13/2016 16:02 jp1 10/13/2016 16:02 10/13/2016 16:02 jp1 Standalone 10/13/2016 16:02 Standalone 10/13/2016 16:02 cn1 active 10/13/2016 16:02 1/1 active 10/13/2016 16:02 1/1 active 10/13/2016 16:02 sg1 standby 10/13/2016 16:02 1/1 standby 10/13/2016 16:02 1/1 standby 10/13/2016 16:02 gb2 All devices in the device group are in sync 10/13/2016 16:02 All devices in the device group are in sync 10/13/2016 16:02 gb2 In Sync 10/13/2016 16:02 In Sync 10/13/2016 16:02 gb1 standby 10/13/2016 16:02 1/1 standby 10/13/2016 16:02 1/1 standby 10/13/2016 16:02 xx1 All devices in the device group are in sync 10/13/2016 16:02 All devices in the device group are in sync 10/13/2016 16:02 xx1 In Sync 10/13/2016 16:02 In Sync 10/13/2016 16:02 xx1 active 10/13/2016 16:02 1/1 active 10/13/2016 16:02 1/1 active 10/13/2016 16:02 ... View more

Looks like my comment didn't post from yesterday. I just wanted to say this latest one will work (Thank You!) but I'd still be interested in seeing if the other will also work without the heavy lockdown. This answer deserves credit none-the-less. I'm getting a lot of understanding from this example. ... View more

Ok, that processed, but the output isn't ideal. I sanitized some results so I'll post that. Here's what I get with the latest code block: host Failover Failover_time Sync_Status Sync_Status_time Status Status_time cn1 active 1476154441 1476154441 1476154441 gb1 standby 1476154443 All devices in the device group are in sync 1476154443 All devices in the device group are in sync 1476154443 gb2 active 1476154441 All devices in the device group are in sync 1476154441 All devices in the device group are in sync 1476154441 in1 active 1476154441 1476154441 1476154441 jp1 active 1476154443 1476154443 1476154443 sg1 standby 1476154443 All devices in the device group are in sync 1476154443 All devices in the device group are in sync 1476154443 sg2 active 1476154443 All devices in the device group are in sync 1476154443 All devices in the device group are in sync 1476154443 us1 standby 1476154443 All devices in the device group are in sync 1476154443 All devices in the device group are in sync 1476154443 us2 active 1476154441 All devices in the device group are in sync 1476154441 All devices in the device group are in sync 1476154441 us3 active 1476154443 1476154443 1476154443 xx1 standby 1476154443 All devices in the device group are in sync 1476154443 All devices in the device group are in sync 1476154443 xx2 active 1476154443 All devices in the device group are in sync 1476154443 All devices in the device group are in sync 1476154443 What I'm expecting is along the lines of: host TIME Failover Status SyncStatus cn1 10/10/2016 22:50 active Standalone gb1 10/10/2016 22:50 standby All devices in the device group are in sync In Sync gb2 10/10/2016 22:50 active All devices in the device group are in sync In Sync in1 10/10/2016 22:50 active Standalone jp1 10/10/2016 22:50 active Standalone sg1 10/10/2016 22:50 standby All devices in the device group are in sync In Sync sg2 10/10/2016 22:50 active All devices in the device group are in sync In Sync us1 10/10/2016 22:50 standby All devices in the device group are in sync In Sync us2 10/10/2016 22:50 active All devices in the device group are in sync In Sync us3 10/10/2016 22:50 active Standalone xx1 10/10/2016 22:50 standby All devices in the device group are in sync In Sync xx2 10/10/2016 22:50 active All devices in the device group are in sync In Sync The last block of results is from the code of Sundareshr which is heavily restricted. I had some pictures but I couldn't see how to upload. Sorry. ... View more

Sorry for not making notes sooner. I was traveling and just got back to this. The first code block had an error when I tried to run it: ⚠ Error in 'eval' command: The expression is malformed. Expected ). I'm fairly sure the assumptions are correct so if the values could be pulled without lockdown, that would be amazing. Do you see where the ")" is supposed to be? ... View more

Sorry for not making notes sooner. I was traveling and just got back to this. Looks like this latest one will work if I know the string responses before hand (and hopefully don't overlap). I'm learning a lot from this, so thank you! I'm still looking at that first one posted to see how it will work but this deserves credit. ... View more

That works much better, thanks! the Status and sync_status aren't the same data so it needs to be played with a bit. I'm getting some bleed-over from Failover in to Status. The only text should be either 'In Sync' or 'Standalone': HOST TIME FAILOVER STATUS SYNCSTATUS cn1 09/29/2016 23:04:02 active 1/1 active gbs1 09/29/2016 23:04:02 active 1/1 active All devices in the device group are in sync gbs2 09/29/2016 23:03:02 standby In Sync All devices in the device group are in sync in1 09/29/2016 23:04:02 active 1/1 active jp1 09/29/2016 23:03:03 active Standalone sg1 09/29/2016 23:04:02 active 1/1 active All devices in the device group are in sync sg2 09/29/2016 23:03:02 standby In Sync All devices in the device group are in sync us1 09/29/2016 23:04:03 active 1/1 active All devices in the device group are in sync us2 09/29/2016 23:04:02 standby 1/1 standby All devices in the device group are in sync us3 09/29/2016 23:04:02 active 1/1 active xx1 09/29/2016 23:03:02 active In Sync All devices in the device group are in sync xx2 09/29/2016 23:03:02 standby In Sync All devices in the device group are in sync ... View more

Thanks for your reply, Sundareshr. I tried your code and it gave me an "Error in 'eval' command: The arguments to the 'if' function are invalid." I also added in the rex for Sync_Status since it was missing but still got the same error. index=team_f5_metrics (F5-BIGIP-SYSTEM-MIB::sysCmFailoverStatusSummary.0 OR F5-BIGIP-SYSTEM-MIB::sysCmSyncStatusSummary.0 OR F5-BIGIP-SYSTEM-MIB::sysCmSyncStatusStatus.0) | rex "1/1 (?<Failover>.*)$" | rex "STRING: (?<Status>.*)$" | rex "STRING: (?<Sync_Status>.*)$" | eval Sync_Status=if("F5-BIGIP-SYSTEM-MIB::sysCmSyncStatusSummary.0", Status, null()) | eval Status=if("F5-BIGIP-SYSTEM-MIB::sysCmSyncStatusSummary.0", null(), Status) | stats latest(Failover) as Failover latest(Status) as Status latest(Sync_Status) as SyncStatus latest(_time) as TIME by host | convert ctime(TIME) | table host TIME Failover Status SyncStatus I haven't dealt with eval and if statements yet. Do you see where there error is? ... View more

Bingo! Looks like the added "as Sync_Status" did it. I learn by examples so this is awesome. Thank you! ... View more

Thanks for the response mydog. I think it's close but we're not quite there. The following is the output from the search. The Sync_Status field is still empty: HOST TIME SYNC_STATUS cn 09/28/2016 19:19:01 gb1 09/28/2016 19:19:01 gb2 09/28/2016 19:19:01 inr 09/28/2016 19:19:01 jpr 09/28/2016 19:19:03 sg1 09/28/2016 19:19:03 sg2 09/28/2016 19:19:03 us1 09/28/2016 19:19:03 us2 09/28/2016 19:19:01 us3 09/28/2016 19:19:01 xx1 09/28/2016 19:19:03 xx2 09/28/2016 19:19:03 As soon as I add the Table line, the Sync_Status is lost in the output. Here's the output from the code minus the Table portion: [ index=team_f5_metrics F5-BIGIP-SYSTEM-MIB::sysCmSyncStatusSummary.0 | rex "STRING: (?.*)$" | stats latest(Sync_Status) latest(_time) as TIME by host ] HOST SYNC_STATUS TIME cn1 1475105041 gb1 All devices in the device group are in sync 1475105043 gb2 All devices in the device group are in sync 1475105041 in1 1475105041 jp1 1475105043 sg1 All devices in the device group are in sync 1475105043 sg2 All devices in the device group are in sync 1475105043 us1 All devices in the device group are in sync 1475105041 us2 All devices in the device group are in sync 1475105043 us3 1475105041 xx1 All devices in the device group are in sync 1475105043 xx2 All devices in the device group are in sync 1475105043 Do you see an error in the search above? ... View more

Works as well 🙂 Thank you for the example. ... View more

Brilliant. Thank you! I'm still learning syntax. I know there are about 10 different ways to accomplish this but I particularly like the catch all *. ... View more