Date="8 May 2020" Link="X" Status="UP" Date="9 May 2020" Link="Y" Status="DOWN" Date="10 May 2020" Link="X" Status="UP" Date="11 May 2020" Link="X" Status="DOWN" Date="12 May 2020" Link="Y" Status="UP" Date="13 May 2020" Link="X" Status="DOWN" I am getting logs on daily basis in above format and data . I am looking to find field Link whose Status went down but never came up and on which date it went DOWN . For example in above case , Link X went down on 11 May but log on 13 May shows its still down so it went down on 11th and is down since 2 days . Following query works but issue is streamstats capture 10000 events by default so it doesn't get data for all links as logs are more than that . |makeresults | eval _raw="Date=\"8 May 2020\" Link=\"X\" Status=\"UP\" Date=\"9 May 2020\" Link=\"Y\" Status=\"DOWN\" Date=\"10 May 2020\" Link=\"X\" Status=\"UP\" Date=\"11 May 2020\" Link=\"X\" Status=\"DOWN\" Date=\"12 May 2020\" Link=\"Y\" Status=\"UP\" Date=\"13 May 2020\" Link=\"X\" Status=\"DOWN\"" | multikv noheader=t | kv | table Date Link Status | eval Date=strptime(Date,"%d %B %Y") | fieldformat Date=strftime(Date,"%F") | sort Link Date | streamstats current=f last(Status) as prev by Link | streamstats count(eval(Status!=prev)) as changed by Link | eventstats last(changed) as session by Link | where changed==session | stats min(Date) as start max(Date) as end values(Status) as Status by session Link | where Status="DOWN" | convert ctime(start) ctime(end) timeformat="%F" ... View more

Hello , I have data from 2 diff source with same fields as shown below : index= sourcetype= source= test.txt device_name="alpha" pool_name="a" device_name="beta" pool_name="b" device_name="gamma" pool_name="c" index= sourcetype= source=test1.txt device_name="alpha" pool_name="a" device_name="beta" pool_name="b" device_name="gamma" pool_name="z" eval actual_pools = toString(device_name) + ";" + toString(pool_name) I am looking for field actual_pools using raw data which i created above which exist in source=test1.txt but not in source=test.txt . tried using join and append but unable to compare . Please help with the same , thanks. ... View more

Hello , I have data from 2 diff source with same fields as shown below : index= sourcetype= source= test.txt device_name="alpha" pool_name="a" device_name="beta" pool_name="b" device_name="gamma" pool_name="c" index= sourcetype= source=test1.txt device_name="alpha" pool_name="a" device_name="beta" pool_name="b" device_name="gamma" pool_name="z" eval actual_pools = toString(device_name) + ";" + toString(pool_name) I am looking for field actual_pools using raw data which i created above which exist in source=test1.txt but not in source=test.txt Thanks ... View more

Example Logs(ignore time format as it is as expected by splunk : 1 jan neibhor is up 10 jan jan neibhor is down 20 jan neibhor is up 30 jan neibhor is down 1 feb neibhor is up I will like to see time diff between down log and up log and if its more than 10 days then show when it went down and came up in table . I was able to see last down event and since when but couldnt get it working what i need . index= "neighbor" AND Up OR Down | rex "neighbor (?\d+.\d+.\d+.\d+) (?\w+") | dedup host | where status = "Down" | eval "Down Since" = toString(date_mday) + " " + toString(date_month) + " " + toString(date_year)| table host ip status "Down Since" ... View more