Splunk Search

conditional search via based on total count

corehan
Explorer

Hello,

Here is my search output. I want see , if Count of "Down" > "Up" criteria. Than I can  understand, interface is stil down!

index=syslog field7="nw_ra_m016_02.34bhsr" "%%01ISIS" AdjState="1" OR AdjState="3" OR AdjState="Down" OR AdjState="Up" |stats count by field7,IfName,AdjState

 

splunkpost.png

Field7 which is host

IfName : Interface name

AdjState : Protocol state which is IS-IS 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Print? I assume you want this piece of information somewhere on the dashboard - decide where and what you want to show then craft the search accordingly, based on the examples shown. Those examples should give you enough to either create a new panel or add to the existing.

 

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@corehan 

If you want a new search to calculate this, then 

index=syslog field7="nw_ra_m016_02.34bhsr" "%%01ISIS" AdjState="1" OR AdjState="3" OR AdjState="Down" OR AdjState="Up" 
| stats sum(eval(if(AdjState="Down",1,0))) as Down sum(eval(if(AdjState="Up",1,0))) as Up by field7 IfName
| eval CurrentState="Interface ".if(Up>Down, "Up", "Down")

and that will give you 'Interface Up' or 'Interface Down'. However, is this a reliable indicator? If the values are the same, then you need to know the starting state of the interface at the start of your search interval, as equal counts will indicate that the interface is in the same state that it was at the start of your search interval.

If you want to add a new column to the existing table you have then do this

| eventstats max(eval(if(AdjState="Down",count,0))) as Down max(eval(if(AdjState="Up",count,0))) as Up by field7 IfName
| eval CurrentState="Interface ".if(Up>Down, "Up", "Down")
| fields - Up Down

Hope this helps

 

0 Karma

corehan
Explorer

Thank you for interesting.

 

Actually, if count of down > up, i want print like warning message. 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Print? I assume you want this piece of information somewhere on the dashboard - decide where and what you want to show then craft the search accordingly, based on the examples shown. Those examples should give you enough to either create a new panel or add to the existing.

 

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...