topic Re: Display sources which do not have a string in Getting Data In

Display sources which do not have a string

nbk7e9d — Tue, 27 Aug 2013 18:50:31 GMT

Hello,

When I restart a large application with hundreds of processes, I can see a string like "startup successful" from the logs.

How can I display a list of host and sources which do not have this string?

host1:/a/b/c1/file1.log
host1:/a/b/c2/file2.log
host1:/a/b/c3/file3.log
host2:/a/b/c1/file1.log
host2:/a/b/c2/file2.log
host2:/a/b/c3/file3.log
...

Suppose host99:/a/b/c13/file23.log did not have the "startup successful" string. How would I display that?

Re: Display sources which do not have a string

kristian_kolb — Tue, 27 Aug 2013 19:34:18 GMT

Proving the negative is a bit harder than opposite. Assuming that all of those files are of the same sourcetype, one approach is to use a simple subsearch;

sourcetype=XXX earliest=-15m NOT [search sourcetype=XXX earliest=-15m "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source

Set the earliest time at the time of the restart, so you don't get irrelevant older events included. In this case I gave the application 15 minutes to startup, before running the search so-to-speak.

Re: Display sources which do not have a string

nbk7e9d — Tue, 27 Aug 2013 22:01:02 GMT

Since I'm selecting a custom time from the timepicker and my sourcetypes aren't exactly the same, I used:

host=host* sourcetype=logs* NOT [search host=host* sourcetype=logs* "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source

This works nicely. Thanks!

Re: Display sources which do not have a string

HiroshiSatoh — Wed, 28 Aug 2013 02:28:48 GMT

Is not output to the list if any (host log is not output) host has not been activated within the specified time that it is the search is present but OK?

Re: Display sources which do not have a string

nbk7e9d — Wed, 28 Aug 2013 17:35:37 GMT

The double negative type question is confusing me. 🙂 This search will give me a table of hosts,logs that do NOT have "start successful" message from the time I choose in the TimePicker.