I have one server with 24 jvms.I need to write query for jvm down .I tried using inputlookup?
|inputlookup sample.csv |eval count=0| table JVMName count | append [search index=was source="/xx.log" NOT F5App |rex field=source "/ws/(?.)/http/access.log"| stats count by JVMName ]| stats sum(count) by JVMName | where count = 0
But i am not getting any alert?
Hi Karthi2809,
As I understand your issue, what you want is the count of only those JVMName which are defined in the lookup file.
As per given eg. if lookup file contains "JVMName" comma separated, then your CSV should be like this:
sample.csv
------------------------
JVMName
"node1,node2,node24"
lookup file should NOT like
sample.csv
------------------------
JVMName
node1,node2,node24 // It will consider only the first value "node1"
With this lookup file the search like this :
search index=was source="/xx.log" [|inputlookup sample.csv | eval JVMName=split(JVMName,",") | mvexpand JVMName | return 24 JVMName] NOT F5App | rex field=source "/ws/(?.)/http/access.log"| stats count by JVMName
==========================================================================================
In the case of lookup file, I suggest that keep JVMName one by one in a row, like:
sample.csv
------------------------
JVMName
node1
node2
node24
With this lookup file the search like this :
search index=was source="/xx.log" [|inputlookup sample.csv | return 24 JVMName ] NOT F5App | rex field=source "/ws/(?.)/http/access.log"| stats count by JVMName
Here, I have used return command to pass value up from subsearch.
I hope this will help you.
Thanks
Kamlesh
Hi Karthi2809,
Are you getting expected result from below search?
index=was source="/xx.log" NOT F5App | rex field=source "/ws/(?.)/http/access.log"
| stats count by JVMName
AND
Can you please provide information regarding sample.csv?
Thanks
Kamlesh
in sample.csv i added jvm names
eg: node1,node2......,node24
what is sample.csv? can u please paste some raw data from index=was source="xx.log" ?