Hi all,
I have an output..
ISIS: Adjacency to IDCSO-WANRTC001 (FastEthernet0/0/0) Down, bfd neighbor down
ISIS: Adjacency to IDCSO-WANRTC001 (FastEthernet0/0/0) Up, new adjacency
COde currently am using.
index=nw_syslog "*CLNS-5-ADJCHANGE*"
| rename _time as Time_CST
| fieldformat Time_CST=strftime(Time_CST,"%x %X")
| dedup hostname, message
| table hostname, Time_CST, message
Output:
hostname Time_CST message
idpbv 03/31/20 06:24:32 ISIS: Adjacency to IDCSO (FastEthernet0/0/0) Down, bfd neighbor down
idpbv 03/31/20 06:24:33 ISIS: Adjacency to IDCSO (FastEthernet0/0/0) Up, new adjacency
idpbv 03/31/20 06:26:32 ISIS: Adjacency to IDCSO (FastEthernet0/2/0) Down, bfd neighbor down
idpbv 03/31/20 06:26:54 ISIS: Adjacency to IDCSO (FastEthernet0/2/0) Up, new adjacency
Expected output By using Regex.
hostname Time_CST Interface Status Count
idpbv 3/31/2020 6:24 FastEthernet0/0/0 UP 2
idpbv 3/31/2020 6:26 FastEthernet0/2/0 UP 2
Hi
Check this
| makeresults
| eval temp="ISIS: Adjacency to IDCSO (FastEthernet0/0/0) Down, bfd neighbor down#ISIS: Adjacency to IDCSO (FastEthernet0/0/0) Up, new adjacency#ISIS: Adjacency to IDCSO (FastEthernet0/2/0) Down, bfd neighbor down#ISIS: Adjacency to IDCSO (FastEthernet0/2/0) Up, new adjacency"
| eval message = split(temp,"#")
| mvexpand message
| rex field=message "\((?P<interface>[^)]+)\)\s+(?P<status>[^,]+)" |table message interface status
Hi
Check this
| makeresults
| eval temp="ISIS: Adjacency to IDCSO (FastEthernet0/0/0) Down, bfd neighbor down#ISIS: Adjacency to IDCSO (FastEthernet0/0/0) Up, new adjacency#ISIS: Adjacency to IDCSO (FastEthernet0/2/0) Down, bfd neighbor down#ISIS: Adjacency to IDCSO (FastEthernet0/2/0) Up, new adjacency"
| eval message = split(temp,"#")
| mvexpand message
| rex field=message "\((?P<interface>[^)]+)\)\s+(?P<status>[^,]+)" |table message interface status
the regexworks
| rex field=message "((?P[^)]+))\s+(?P[^,]+)" |table message interface status