hello all,
I have a lookup with two fields sourcetype and interval ( like below) ..some of the intervals are in seconds (which is great) - However some are in cron like (14 01 * * *) --I need to change the ones in cron to 86400 ...Any ideas
sourcetype interval
blah 300
blah2 15 01 * * * *
blah3 3600
blah4 18 02 * * *
Here is my comically bad regex I've been working with, but cant seem to make it work
| rest splunk_server=local /services/data/inputs/script
| search (disabled = 0 AND interval=*)
| dedup sourcetype
| eval output=if(match(interval="(\d+)(\d+).(\d).(*).(*).(*)")),"86400","interval")
| table sourcetype interval output
Thanks!
| rest splunk_server=local /services/data/inputs/script
| search (disabled = 0 AND interval=*)
| eval output=if(match(interval,"^-?\d+$"),"interval","86400")
| stats values(interval) as interval values(output) as output by sourcetype
Hi, @spluzer
How about this?
| rest splunk_server=local /services/data/inputs/script
| search (disabled = 0 AND interval=*)
| eval output=if(match(interval,"^-?\d+$"),"interval","86400")
| stats values(interval) as interval values(output) as output by sourcetype
Hi, @spluzer
How about this?
Awesome thanks!..You answered my question perfectly, and will accept accordingly. However, I now realize that it probably makes more sense for me to "replace" the intervals with a cron schedule with 86400 rather than create a new field called output ( for the sake of writing it to a lookup)...Do you have a way to do that...I can ask it in other question form if you prefer...Thanks again!
Hi
Check this
| rest splunk_server=local /services/data/inputs/script
| search (disabled = 0 AND interval=*)
| eval interval=if(match(interval,"^-?\d+$"),'interval',"86400")
| stats values(interval) as interval by sourcetype
Yep, that does it. I'm an idiot ..lol...Thanks!