Have good day for Everybody
Pls help me to search exactly the content.
My input log is:
status system replication site "1": ERROR
status system replication site "3": ACTIVE
overall system replication status: ERROR.
My search and will add the alert:
index="...." host="..." status system replication site "1": ACTIVE | head 1
the result is:
status system replication site "1": ERROR
status system replication site "3": ACTIVE
overall system replication status: ERROR.
But i couldn't know: site "1" ACTIVE or ERROR.
Pls help me define the searching.
Thank
Hi Giuseppe,
The full one log have 32 line. i only copy the 3 line. This is not the log. Only i export the command line to the log file and send his file to the splunk. The log content is:
| SYSTEMDB | p-crm-db01 | 30601 | nameserver | 1 | 2 | CRM01 | p-crm-db02 | 30601 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| QP2 | p-crm-db01 | 30652 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30652 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| RP2 | p-crm-db01 | 30640 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30640 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| JP2 | p-crm-db01 | 30646 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30646 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| CP2 | p-crm-db01 | 30643 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30643 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| OP2 | p-crm-db01 | 30649 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30649 | 1 | CRM02 | YES | SYNC | ACTIVE | |
status system replication site "1": ACTIVE
status system replication site "3": ERROR
overall system replication status: ERROR
Show that i want to detect the log file about that:
status system replication site "3": ACTIVE or ERROR.
If i search the content about that:
index=linux host="..." ("status system replication site "3": ACTIVE")
the result is :
status system replication site "1": ACTIVE
status system replication site "3": ERROR
overall system replication status: ERROR
This is false the result.
Thank
Hi Giuseppe,
The full one log have 32 line. i only copy the 3 line. This is not the log. Only i export the command line to the log file and send his file to the splunk. The log content is:
| SYSTEMDB | p-crm-db01 | 30601 | nameserver | 1 | 2 | CRM01 | p-crm-db02 | 30601 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| QP2 | p-crm-db01 | 30652 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30652 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| RP2 | p-crm-db01 | 30640 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30640 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| JP2 | p-crm-db01 | 30646 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30646 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| CP2 | p-crm-db01 | 30643 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30643 | 1 | CRM02 | YES | SYNC | ACTIVE | |
| OP2 | p-crm-db01 | 30649 | indexserver | 2 | 2 | CRM01 | p-crm-db02 | 30649 | 1 | CRM02 | YES | SYNC | ACTIVE | |
status system replication site "1": ACTIVE
status system replication site "3": ERROR
overall system replication status: ERROR
Show that i want to detect the log file about that:
status system replication site "3": ACTIVE or ERROR.
If i search the content about that:
index=linux host="..." ("status system replication site "3": ACTIVE")
the result is :
status system replication site "1": ACTIVE
status system replication site "3": ERROR
overall system replication status: ERROR
This is false the result.
Thank
Hi dangtran,
beware that you have quotes in your strings so you have to escape them in searches
index=linux host="..." "status system replication site \"3\": ACTIVE"
or use a rex command
index=linux host="..." | rex "status system replication site \"3\": ACTIVE"
in this way you take only the row where you have status system replication site "3": ACTIVE
Bye.
Giuseppe
Hi Giuseppe,
This working. Thank you very much.
Have good day for you.
Hi dangtran,
let me understand: do you want to find the first occurrance of the string status system replication site "1": ACTIVE
or other?
If you want the exact string use quotes (").
There's a thing that I don't understand: you used | head 1
, why you say that you received as result three strings?
status system replication site "1": ERROR
status system replication site "3": ACTIVE
overall system replication status: ERROR.
In addition, in your example there isn't any row that matches the search string, so you should not have any result.
Bye.
Giuseppe
If you're satisfied, pleace accept or upvote my answer.
By.
Giuseppe