Good afternoon,  I can't make sense of why I can't extract a definition from a particular csv.  I doublechecked permissions and verified that all of my columns are appearing via | inputlookup file.csv | table loopback, device the output recognizes both the custom device data as well as loopback but if I attempt to table the info "device" is not recognized.  index=index "syslog message" | rex field=_raw "peer (?<neighbor>\d+.\d+.\d+.\d+.)" | dedup neighbor | lookup xo-access-loopback loopback as neighbor output device | table device, neighbor I get neighbor output but not device.  csv looks like -  Any ideas? device loopback routername x.x.x.x ... View more

I have two different searches running against 2 different indexes to pull in realtime syslog data and enrich it with snmp polling data, like circuit information etc.  My first search is looking for a specific syslog text and returning with all necessary results, while my second search is doing the exact same thing but does not show any stats.  Each one of these searches and sub searches function individually so I don't understand why one works and not the other. The only ostensible change in either search are the explicit syslog text queries and manual evals to push into the table so I can't make sense of why it's failing. Any ideas or recommendations? first example - (working) syslog text - <28>Jun 29 18:22:25 DEVICE mib2d[2775]: SNMP_TRAP_LINK_DOWN: , ifAdminStatus up(1), ifOperStatus down(2), ifName ge-5/0/3 index=syslog "ifOperStatus down" | rex field=_raw "ifName (?<ifDescr>.+)" | eval deviceName = host | eval TriggerDescription = message | eval Environment="prod" | eval SourceEventID = "" | eval AlarmType = "Router" | eval Domain = "XO" | eval SourceSystem = "NI Splunk" | eval SendtoNOC = "Y" | eval EventStatus = "NEW" | eval ProductName = "XO" | eval ElementType = "Device" | eval TriggerUnitsofMeasure = "" | eval KPIMeasure = "" | eval CaseDescription = "Backbone Interface Down" | eval StateCode = "XO" | eval Severity = "Major" | lookup xo-cili-lookup device as deviceName output cili as NEID | eval Port = ifDescr | eval TriggerType = "Interface Down" | eval Cause = TriggerType | eval DeviceClli = NEID | eval Vendor = "Juniper" | eval model=case(match(deviceName, "MCR*|CIR*|mcr*|cir*"), "MX960", match(deviceName, "CTR*|ctr*"), "MX2020", match(deviceName, "RCA*|RCB*|rca*|rcb*"), "PTX5000", match(deviceName, "LCA*|LCB*|lca*|lcb*"), "PTX3000") | eval DeviceModel = model | join deviceName, ifDescr [search index=SNMP ifDescr=ae* OR ifDescr=et-* OR ifDescr=xe-* OR ifDescr=ge-* AND ifAlias=*bone* | eval no_circuitid="" | rex field=ifAlias ":(?<circuitID>\d+\s?\/[^\/]+[^\/]+\/[^\/]+\/[^\/|\:|\s]+)" | eval circuitID=coalesce(circuitID, no_circuitid) | eval AID = circuitID | eval AlarmKey = deviceName." ".ifAlias." Down" | stats latest(ifAlias) as ifAlias values latest(_time) as LatestAlertedTS, earliest(_time) as FirstAlertedTS by AlarmKey,deviceName, ifDescr, AID,circuitID] | table Environment,AlarmKey,FirstAlertedTS, LatestAlertedTS,EventStatus,deviceName,ifDescr,NEID,AID,circuitID,Port, Severity, TriggerType,TriggerDescription,Cause, DeviceClli, Vendor, DeviceModel, SourceEventID, SourceSystem, Domain,ProductName, ElementType, TriggerUnitsofMeasure, KPIMeasure, CaseDescription, SendtoNOC, StateCode, AlarmType Collapse | dedup AlarmKey Second example (not working) Syslog text - <28>Jun 29 18:56:38 DEVICE lfmd[17284]: LFMD_3AH_THRESHOLD_EVENT: Threshold event happened for ifd et-8/0/8(snmpid 525): index=SYSLOG LFMD_3AH_THRESHOLD_EVENT | rex field=_raw "event happened for ifd (?<ifDescr>\S+)\(snmpid" | rare host | eval deviceName = upper(host) | eval TriggerDescription = message | eval Environment="prod" | eval SourceEventID = "" | eval AlarmType = "Router" | eval Domain = "XO" | eval SourceSystem = "NI Splunk" | eval SendtoNOC = "Y" | eval EventStatus = "NEW" | eval ProductName = "XO" | eval ElementType = "Device" | eval TriggerUnitsofMeasure = "" | eval KPIMeasure = "" | eval CaseDescription = "Backbone Interface Errors" | eval StateCode = "XO" | eval Severity = "Major" | lookup xo-cili-lookup device as deviceName output cili as NEID | eval Port = ifDescr | eval TriggerType = "PCS Errors" | eval Cause = TriggerType | eval DeviceClli = NEID | eval Vendor = "Juniper" | eval model=case(match(deviceName, "MCR*|CIR*|mcr*|cir*"), "MX960", match(deviceName, "CTR*|ctr*"), "MX2020", match(deviceName, "RCA*|RCB*|rca*|rcb*"), "PTX5000", match(deviceName, "LCA*|LCB*|lca*|lcb*"), "PTX3000") | eval DeviceModel = model | join deviceName, ifDescr [search index=SNMP deviceName=RCA* OR deviceName=RCB* OR deviceName=LCA* OR deviceName=RCB* ifAlias=*bone* | eval no_circuitid="" | rex field=ifAlias ":(?<circuitID>\d+\s?\/[^\/]+[^\/]+\/[^\/]+\/[^\/|\:|\s]+)" | eval circuitID=coalesce(circuitID, no_circuitid) | eval AID = circuitID | eval AlarmKey = deviceName." ".ifAlias." PCS Errors" | stats latest(ifAlias) as ifAlias values latest(_time) as LatestAlertedTS, earliest(_time) as FirstAlertedTS by AlarmKey,deviceName, ifDescr, AID, circuitID] | table Environment,AlarmKey,FirstAlertedTS, LatestAlertedTS,EventStatus,deviceName,ifDescr,NEID,AID,circuitID,Port, Severity, TriggerType,TriggerDescription,Cause, DeviceClli, Vendor, DeviceModel, SourceEventID, SourceSystem, Domain,ProductName, ElementType, TriggerUnitsofMeasure, KPIMeasure, CaseDescription, SendtoNOC, StateCode, AlarmType Collapse   ... View more