Hello,
I am attempting to raise a group of fields to the power of 2 but Splunk is not returning any results. Below is my search terms
Here is an actual log sample and the full search syntax. Neither of the suggested solutions worked.
Log:
2017-03-20 07:14:24,809 [ INFO] {AWT-EventQueue-0} trcs.patient_id=
2017-03-20 07:14:25,296 [ INFO] {EMRC Controller Event Queue} beam 1 is selected.
2017-03-20 07:29:30,708 [ INFO] {applicationQueue} PPVS Controller Activity ALIGN: valid SROB: PpsPosition(X:6.683775778257897mm,Y:-4.458019220244911mm,Z:9.54765mm,Rotation:359.3072792875074deg,Pitch:0.03151268032095971deg,Roll:0.0deg).
2017-03-20 07:29:32,016 [ INFO] {applicationQueue} pms.correction_applied
2017-03-20 07:30:16,688 [ INFO] {applicationQueue} PPVS Controller Activity ALIGN: valid SROB: PpsPosition(X:0.11733mm,Y:-1.79059mm,Z:0.12328mm,Rotation:-0.0deg,Pitch:0.0deg,Roll:-0.0deg).
2017-03-20 07:30:17,963 [ INFO] {applicationQueue} pms.correction_applied
2017-03-20 07:30:53,554 [ INFO] {applicationQueue} PPVS Controller Activity ALIGN: valid SROB: PpsPosition(X:0.0mm,Y:0.0mm,Z:0.0mm,Rotation:-0.0deg,Pitch:0.0deg,Roll:-0.0deg).
2017-03-20 07:31:05,568 [ INFO] {EMRC Controller Event Queue} beam 2 is selected.
2017-03-20 07:37:31,951 [ INFO] {applicationQueue} PPVS Controller Activity ALIGN: valid SROB: PpsPosition(X:-0.04683mm,Y:0.78357mm,Z:-2.1995mm,Rotation:-0.0deg,Pitch:0.0deg,Roll:-0.0deg).
2017-03-20 07:37:34,271 [ INFO] {applicationQueue} pms.correction_applied
2017-03-20 07:38:05,340 [ INFO] {applicationQueue} PPVS Controller Activity ALIGN: valid SROB: PpsPosition(X:0.0mm,Y:0.0mm,Z:0.0mm,Rotation:-0.0deg,Pitch:0.0deg,Roll:-0.0deg).
2017-03-20 07:38:53,284 [ INFO] {AWT-EventQueue-0} trcs.tsm_state=Irradiation
2017-03-20 07:40:50,099 [ INFO] {Application Queue} BeamResult received. Status : NORMAL Dose : 299.52671427910855
2017-03-20 07:40:59,430 [ INFO] {EMRC Controller Event Queue} beam 3 is selected.
2017-03-20 07:42:49,390 [ INFO] {applicationQueue} PPVS Controller Activity ALIGN: valid SROB: PpsPosition(X:-0.05384mm,Y:-1.2406mm,Z:-5.11836mm,Rotation:-0.0deg,Pitch:-0.0deg,Roll:-0.0deg).
2017-03-20 07:42:51,015 [ INFO] {applicationQueue} pms.correction_applied
2017-03-20 07:43:22,978 [ INFO] {applicationQueue} PPVS Controller Activity ALIGN: valid SROB: PpsPosition(X:0.0mm,Y:0.0mm,Z:0.0mm,Rotation:-0.0deg,Pitch:-0.0deg,Roll:-0.0deg).
2017-03-20 07:44:17,183 [ INFO] {AWT-EventQueue-0} trcs.tsm_state=Irradiation
2017-03-20 07:45:41,170 [ INFO] {Application Queue} BeamResult received. Status : NORMAL Dose : 292.9592996822634
2017-03-20 07:45:57,948 [ INFO] {EMRC Controller Event Queue} session is closed.
Search:
index=logs source=*treat* OR source=*pms* date_hour<=16 date_hour>=7 AND "trcs.patient_id" OR "session is closed" OR "is selected" OR "PPVS Controller Activity ALIGN: valid SROB: PpsPosition("
OR "trcs.tsm_state=Irradiation" OR "BeamResult Received" OR "pms.correction_applied"|
rex field=description "(X:(?-?\d+.\d+\D?-?\d?\d?)mm,Y:(?-?\d+.\d+\D?-?\d?\d?)mm,Z:(?-?\d+.\d+\D?-?\d?\d?)mm,Rotation:(?-?\d+.\d+\D?-?\d?\d?)deg,Pitch:(?-?\d+.\d+\D?-?\d?\d?)deg,Roll:(?-?\d+.\d+\D?-?\d?\d?)deg)" |
eval x=round(x,1) |
eval y=round(y,1) |
eval z=round(z,1) |
eval rot=round(rot,1) |
eval pitch=round(pitch,1) |
eval roll=round(roll,1) |
sort 0 _time|
eval bn=beam_number|
eval bn=if(searchmatch("session is closed"), tonumber("0"), bn)|
streamstats last(bn) as "beam"|
eval CVCoord=if(searchmatch("SROB"),mvappend(beam,x,y,z,rot,pitch,roll),null())|
eval CVCoord=mvjoin(CVCoord,", ")|
sort 0 -_time|
transaction startswith="patient_id" endswith="is closed" maxspan=2h by host|
search trcs_patient_id!="A141070" trcs_patient_id!="A142388" trcs_patient_id!="A160539" trcs_patient_id!="A170316" trcs_patient_id!="A153361" trcs_patient_id!="A161805" trcs_patient_id!="A161809" "Irradiation" "BeamResult Received" "pms.correction_applied"|
sort _time|
mvexpand CVCoord|
rex field=CVCoord "(?\d),(?.+),(?.+),(?.+),(?.+),(?.+),(?.+)" |
search BEAM!=0|
eval part=if(BEAM=1, "Setup", "Treatment")|
eval X2=pow(X,2)|
eval Y2=pow(Y,2)|
eval Z2=pow(Z,2)|
eval Norm2=X2+Y2+Z2|
eval Norm=round(sqrt(Norm2))|
chart count over Norm by part
The chart doesn't return any results for because Norm doesnt contain any values from X2, Y2, or Z2 and thus doesn't return any results. I have confirmed that values exist for X, Y, and Z from my rex command but they aren't being raised to the power of 2 and instead Splunk is just returning blank values to the fields X2, Y2, and Z2. Can anyone help?
↧