topic Re: How do I constantly check the log if a connection is up or not? in Getting Data In

How do I constantly check the log if a connection is up or not?

timmag — Fri, 06 Apr 2018 08:32:52 GMT

I have a host and source.
host="xyz" source="abc"

They give me results every minute whether the connection is up or not. My question is how do I write a query that continuously keeps checking the connection every minute and shows up if everything is fine and shows down if there is a connection fail for greater than 5 mins (i.e. the log would contain the connection is down 5 times)

Re: How do I constantly check the log if a connection is up or not?

p_gurav — Fri, 06 Apr 2018 09:06:24 GMT

You can use | metadata type=hosts and then select fields you want and apply condition.

Re: How do I constantly check the log if a connection is up or not?

splunker12er — Fri, 06 Apr 2018 09:22:37 GMT

Makeresults| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60

Re: How do I constantly check the log if a connection is up or not?

timmag — Fri, 06 Apr 2018 09:31:14 GMT

I'm not sure I understood that. What is Makeresults?

Re: How do I constantly check the log if a connection is up or not?

splunker12er — Fri, 06 Apr 2018 09:42:19 GMT

Make your results 🙂

Index=* host=hostname source=sourcename| above query

Re: How do I constantly check the log if a connection is up or not?

timmag — Fri, 06 Apr 2018 09:49:22 GMT

Oopsy. Got it. But, I was getting this error: Error in 'tstats' command: This command must be the first command of a search... So I thought, that was something. 😛

Re: How do I constantly check the log if a connection is up or not?

timmag — Fri, 06 Apr 2018 10:10:15 GMT

I still don't get it. Even if I try using simple stats command, it returns index error

Re: How do I constantly check the log if a connection is up or not?

MKowalewski — Fri, 06 Apr 2018 10:25:47 GMT

| makeresults [| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60]
@timmag this sould work fine