topic Re: How to check since when the nodes are down under one particular FQDN in Dashboards & Visualizations

How to check since when the nodes are down under one particular FQDN

aj2551988 — Tue, 29 Sep 2020 20:26:19 GMT

Hello,

I have a Splunk dashboard, wherein I can see there are multiple nodes down under multiple FQDN,

I opened the search for the nodes which are down and it showed below query -

host=smon* "nagios: HOST_PROBLEM:" "DOWN" | rex field=_raw "nagios: HOST_PROBLEM: (?.😞 (?.😞 DOWN: (?.*)" | dedup hostname host

The above query resulted in multiple nodes down but the result shows aggregated results for all the FQDNs.

I want to also see since when the nodes are down.

Is there any way we can check it?

![alt text][1] ![alt text][2]

[1]: /storage/temp/252199-2.jpg // showing the actual total number of nodes down.
[2]: /storage/temp/252198-1.jpg // showing the nodes which are under for the perticular FQDN

Re: How to check since when the nodes are down under one particular FQDN

renjith_nair — Fri, 13 Jul 2018 13:31:02 GMT

Hi @aj2551988,

Try

    host=smon* "nagios: HOST_PROBLEM:" "DOWN" | rex field=_raw "nagios: HOST_PROBLEM: (?.): (?.): DOWN: (?.*)" |stats latest (_time) as last_seen by host,hostname

Re: How to check since when the nodes are down under one particular FQDN

woodcock — Sun, 15 Jul 2018 17:50:01 GMT

Your rex is doing nothing so fix it or drop it. Maybe this?

host=smon* "nagios: HOST_PROBLEM:" "DOWN" 
| dedup hostname host
| table _time hostname host

Re: How to check since when the nodes are down under one particular FQDN

aj2551988 — Mon, 16 Jul 2018 12:20:43 GMT

Hello,

When Tried the above query, it is giving the error -

"Error in 'rex' command: Encountered the following error while compiling the regex 'nagios: HOST_PROBLEM: (?.): (?.): DOWN: (?.*)': Regex: unrecognized character after (? or (?-"

And

"The search job has failed due to an error. You may be able view the job in the Job Inspector."

Re: How to check since when the nodes are down under one particular FQDN

renjith_nair — Mon, 16 Jul 2018 12:38:31 GMT

Your rex seems to be wrong. What you need to extract ? If you only host and hostname , you might not need that. If you need to extract something, post a sample event