Getting Data In

Need seperate count for UP and DOWN Peer

jerinvarghese
Communicator

Hi All,

I have a query to display some BGP neighbour UP or DOWN.

Output looks like
nodelabel Status PEER_IP Time_CST
Device1 UP 10.253.226.10 01/08/20 02:03:53
Device2 DOWN 10.253.140.89 01/08/20 00:26:54

Query is :

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST

I need a help, want to display how many UP and DOWN peers there.

0 Karma
1 Solution

TISKAR
Builder

Hello,

First method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST
| eval number_Up=if(Status="UP",1,0), number_Down=if(Status="DOWN",1,0)
| stats sum(number_Up) as UP, sum(number_Down) as DOWN

Second method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
    | rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
    | rex "peer: (?.*), eventseverity"
    | eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
    | rename _time as Time_CST
    | fieldformat Time_CST=strftime(Time_CST,"%x %X")
    | dedup nodelabel sortby - Time_CST
    | table nodelabel Status PEER_IP Time_CST
    | stats count(eval(Status="UP")) as UP, count(eval(Status="DOWN")) as DOWN

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253.*"
| rex "peer: (?<PEER_IP>.*), eventseverity"
| stats count(eval(searchmatch("XOM-rearm"))) AS UP count(eval(searchmatch("XOM-falling"))) AS DOWN values(PEER_IP) AS PEER_IP by nodelabel

hi, only count up & down by nodelabel.

0 Karma

TISKAR
Builder

Hello,

First method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup nodelabel sortby - Time_CST
| table nodelabel Status PEER_IP Time_CST
| eval number_Up=if(Status="UP",1,0), number_Down=if(Status="DOWN",1,0)
| stats sum(number_Up) as UP, sum(number_Down) as DOWN

Second method:

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
    | rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
    | rex "peer: (?.*), eventseverity"
    | eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
    | rename _time as Time_CST
    | fieldformat Time_CST=strftime(Time_CST,"%x %X")
    | dedup nodelabel sortby - Time_CST
    | table nodelabel Status PEER_IP Time_CST
    | stats count(eval(Status="UP")) as UP, count(eval(Status="DOWN")) as DOWN
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jerinvarghese
Try

YOUR_SEARCH | stats count(eval(Status="UP")) as UP_Count count(eval(Status="DOWN")) as DOWN_Count
0 Karma

jerinvarghese
Communicator

thanks for the query it helped.

0 Karma

WalshyB
SplunkTrust
SplunkTrust

use something like this on the end?

| stats count as Total count(eval(Status=="UP")) as "up_count" count(eval(Status=="DOWN")) as "down_count"

Or

index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*"
| rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)"
| rex "peer: (?.*), eventseverity"
| eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other")
| dedup nodelabel
| stats dc(PEER_IP) as Total by Status

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...