Splunk query: how to differentiate max values after regex

Eitan Zair 0
Viewed 39

Let's say I have the following chart: Input chart

I'm interested only in the 2nd and 4th fields in the 'version' column (e.g. 22.180.0.2) I want to call all events which has:

Maximum value on both 2nd and 4th fields - as "BEST" (in the example: 22.180.1.3)

(NOT max value on 2nd field) AND (Maximum value on 4th field from each one of the values before the AND, for example 170, 160) - as "GOOD" (in the example: 22.170.0.2,22.160.0.3)

All the rest - as "OK".

I've managed to separate the fields using regex, but couldn't do the differentiation.

Thanks a lot!

splunk-query splunk
1 Answers

I think you want

| rex field=version "(?<first>[0-9]+)\.(?<second>[0-9]+)\.(?<third>[0-9]+)\.(?<fourth>[0-9]+)"
| eventstats max(second) as max_second,
| eventstats max(fourth) as max_fourth by second
| eval status=if(second=max_second and fourth=max_fourth,"BEST",if(second!=max_second and fourth=max_fourth,"GOOD","OK"))

You need two eventstats commands because one of them groups by the second part and the other one doesn't group at all. I don't think there is any way to do it with one eventstats.

Here is a run-anywhere example:

| makeresults
| eval _raw="
index version
1     22.180.0.1
2     22.180.0.2
3     22.180.0.3
4     22.170.0.1
5     22.170.0.2
6     22.160.0.1
7     22.160.0.2
8     22.160.0.3
9     22.160.0.4
"
| multikv forceheader=1 fields index version
| table index version
| rex field=version "(?<first>[0-9]+)\.(?<second>[0-9]+)\.(?<third>[0-9]+)\.(?<fourth>[0-9]+)"
| eventstats max(second) as max_second,
| eventstats max(fourth) as max_fourth by second
| eval status=if(second=max_second and fourth=max_fourth,"BEST",if(second!=max_second and fourth=max_fourth,"GOOD","OK"))
| fields - first second third fourth max_first max_second max_third max_fourth
Jerry Jeremiah0
Related