Splunk Search

Search doesn't show results if for the same node are present two type of alarms

ngerosa
Path Finder

Hello,
I have a query that extract some type of alarms divided by NODE.
These are the columns of the query:

_time ALARM NODE

If for the same NODE is present ALARM = "FAN-IS" and ALARM="SRMISS" I don't want to show the two rows of the two alarms.

Example:

2017-07-11 13:00:25 FAN-IS MILAN
2017-07-11 13:01:42 SRMISS MILAN
2017-07-11 14:10:12 CARD-PROBLEM ROME

I want to show only:

2017-07-11 14:10:12 CARD-PROBLEM ROME

Any ideas?

Thanks!

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

Your query giving fields _time ALARM NODE
| eventstats values(ALARM) as alarms by NODE
| where NOT (isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS"))) 

Updated answer

 Your query giving fields _time ALARM NODE
  | eventstats values(ALARM) as alarms by NODE
  | eval shouldKeep=if(isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS")),"No","Yes")
  | where shouldKeep="Yes"

ngerosa
Path Finder

Hi somesoni2,
I tried but it didn't work.
The following is the results of the search:

ALARM NODE _time alarms
SRMISS MILAN 2017-06-21 13:08:18.0 FAN-IS
SRMISS

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

Your query giving fields _time ALARM NODE
 | eventstats values(ALARM) as alarms by NODE
 | where isnull(mvfind(alarms,"FAN-IS")) AND isnull(mvfind(alarms,"SRMISS"))
| fields - alarms
0 Karma

ngerosa
Path Finder

It doesn't work.
The search include all alarms (FAN-IS and SRMISS)

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this?

Your query giving fields _time ALARM NODE
 | eventstats values(ALARM) as alarms by NODE
 | eval shouldKeep=if(isnotnull(mvfind(alarms,"FAN-IS")) AND isnotnull(mvfind(alarms,"SRMISS")),"No","Yes")
 | where shouldKeep="Yes"

If this doesnt work then remove last where clause and see if the values are coming per your requirement (manual check).

0 Karma

ngerosa
Path Finder

It works!!
Thank you very much!
If you modify the answer I'll accept!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...