Other Usage

Rename a field in eval condition

man03359
Communicator

Hi All, I am relatively new to splunk.

I am trying to build a search query and below is the condition of the query-

| eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")) 
OR (src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed"))
OR (src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed"))
OR (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120)))
OR (src="retaillineitemdup" AND Count>0)
OR (src="esbmessagecount" AND MsgCount>5),"Down","Up")

| stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain

 I am facing problem in line no 4 which is -

(src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120)))It is reading all 3 filenames as one (Fname).

The source "retailautonomyfileage has 3 filenames (Fname="mdmdat" , Fname="omsdat", Fname="promodat")

and when I do the stats count, not sure why it is counting the sum of all 3  filenames altogether in the output (18 instead of 6)-

Output-

DeviceStoresrchostChainStoreNumDomaincount
stp-020sql1stp0020DB_Rebuild_Indexes_UpdateStats_MDMstp-020sql1.stp.localstp20stp.local6
stp-020sql1stp0020DB_Stop_IndexRebuild_Jobsstp-020sql1.stp.localstp20stp.local6
stp-020sql1stp0020RetailAutonomyDataSyncstp-020sql1.stp.localstp20stp.local6
stp-020sql1stp0020RetailAutonomyPromotionsDataSyncstp-020sql1.stp.localstp20stp.local6
stp-020sql1stp0020esbmessagecountstp-020sql1.stp.localstp20stp.local6
stp-020sql1stp0020retailautonomyfileagestp-020sql1.stp.localstp20stp.local18
stp-020sql1stp0020retaillineitemdupstp-020sql1.stp.localstp20stp.local6
stp-089sql1stp0089DB_Rebuild_Indexes_UpdateStats_MDMstp-089sql1.stp.localstp89stp.local6
stp-089sql1stp0089DB_Stop_IndexRebuild_Jobsstp-089sql1.stp.localstp89stp.local6

 

I am trying to break it into 3 lines under the search query . eg 

(src="retailautonomyfileage1") AND (Fname="mdmdat" AND Age>240)) 

(src="retailautonomyfileage2" AND (Fname="omsdat" AND Age>240))

(src="retailautonomyfileage3" AND (Fname="promodat" AND Age>120))

Not sure how I can obtain that. Please help.

 

Thanks in Advance.

Labels (3)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If I understand correctly, you could try something like this:

| eval src=case(src="retailautonomyfileage" AND Fname="mdmdat", "retailautonomyfileage1", src="retailautonomyfileage" AND Fname="omsdat", "retailautonomyfileage2", src="retailautonomyfileage" AND Fname="promodat", "retailautonomyfileage3", true(), src)
| eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")) 
OR (src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed")) 
OR (src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed"))
OR ((src="retailautonomyfileage1" OR src="retailautonomyfileage2") AND Age>240) OR (src="retailautonomyfileage3" AND Age>120)
OR (src="retaillineitemdup" AND Count>0)
OR (src="esbmessagecount" AND MsgCount>5),"Down","Up")

| stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If I understand correctly, you could try something like this:

| eval src=case(src="retailautonomyfileage" AND Fname="mdmdat", "retailautonomyfileage1", src="retailautonomyfileage" AND Fname="omsdat", "retailautonomyfileage2", src="retailautonomyfileage" AND Fname="promodat", "retailautonomyfileage3", true(), src)
| eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")) 
OR (src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed")) 
OR (src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed"))
OR ((src="retailautonomyfileage1" OR src="retailautonomyfileage2") AND Age>240) OR (src="retailautonomyfileage3" AND Age>120)
OR (src="retaillineitemdup" AND Count>0)
OR (src="esbmessagecount" AND MsgCount>5),"Down","Up")

| stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain

man03359
Communicator

This worked, thanks a lot 🙂

Good day.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @man03359,

as I already asked, do you have the same issue also dividing the eval command by src?

| eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")) ,"Down","Up")
| eval status=if(src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed")),"Down","Up") 
| eval status=if(src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed")),"Down","Up")
| eval status=if(src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120))),"Down","Up")
| eval status=if(src="retaillineitemdup" AND Count>0),"Down","Up")
| eval status=if(src="esbmessagecount" AND MsgCount>5),"Down","Up")
| stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...