https://community.splunk.com/t5/Splunk-Search/Matching-Results-of-a-Search-on-One-Value-Based-on-the-Results/m-p/545498#M154522 <P>Hello,</P><P>I am trying to configure alerting for a Failover Cluster by verifying the running server name, then confirming that the windows services on said server is running as expected.&nbsp; We have two servers in the cluster that could change anytime, where the one that is active should always have the windows services running (and alert if they are not and it is the active host) and the passive server should have the services stopped (expected, no alert).</P><P>The two WMI events that I have running on the two hosts are below:</P><P><STRONG>This event shows the active failover server:</STRONG></P><P><BR /><STRONG>Server</STRONG>=Server1<BR />ComputerName=Cluster<BR />wmi_type=PIAnalysisCluster</P><P><STRONG>The below events shows the Windows Service events on either host:</STRONG></P><P><BR />Caption=Cluster Service<BR />DisplayName=Cluster Service<BR />Name=ClusSvc<BR />ProcessId=3192<BR />StartName=LocalSystem<BR />State=Running<BR />Status=OK<BR /><STRONG>SystemName</STRONG>=Server1<BR />wmi_type=ClusterService</P><P>20210325160700.359614<BR />Caption=Cluster Service<BR />DisplayName=Cluster Service<BR />Name=ClusSvc<BR />ProcessId=3040<BR />StartName=LocalSystem<BR />State=Running<BR />Status=OK<BR /><STRONG>SystemName</STRONG>=Server2<BR />wmi_type=ClusterService<BR /><BR />What i am trying to do is just show where Server=Server1 is active, then show <EM>just</EM> the status of the Windows Server from SystemName=Server1. I've tried with "eval Server=coalesce(SystemName,Server)", evals on match (Server==SystemName) as well "where Server=SystemName", but I have been unable to find a way to just show the active server based on the first event, and match the server name based on the second event with the status of the Windows Service.</P><P>Example attached of what the data looks like without attempting to join the values.<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Razziq_0-1616715820198.png" style="width: 785px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/13501i7C664780CB384A18/image-dimensions/785x199?v=v2" width="785" height="199" role="button" title="Razziq_0-1616715820198.png" alt="Razziq_0-1616715820198.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P> Thu, 25 Mar 2021 23:43:54 GMT Razziq 2021-03-25T23:43:54Z https://community.splunk.com/t5/Splunk-Search/Matching-Results-of-a-Search-on-One-Value-Based-on-the-Results/m-p/545498#M154522 <P>Hello,</P><P>I am trying to configure alerting for a Failover Cluster by verifying the running server name, then confirming that the windows services on said server is running as expected.&nbsp; We have two servers in the cluster that could change anytime, where the one that is active should always have the windows services running (and alert if they are not and it is the active host) and the passive server should have the services stopped (expected, no alert).</P><P>The two WMI events that I have running on the two hosts are below:</P><P><STRONG>This event shows the active failover server:</STRONG></P><P><BR /><STRONG>Server</STRONG>=Server1<BR />ComputerName=Cluster<BR />wmi_type=PIAnalysisCluster</P><P><STRONG>The below events shows the Windows Service events on either host:</STRONG></P><P><BR />Caption=Cluster Service<BR />DisplayName=Cluster Service<BR />Name=ClusSvc<BR />ProcessId=3192<BR />StartName=LocalSystem<BR />State=Running<BR />Status=OK<BR /><STRONG>SystemName</STRONG>=Server1<BR />wmi_type=ClusterService</P><P>20210325160700.359614<BR />Caption=Cluster Service<BR />DisplayName=Cluster Service<BR />Name=ClusSvc<BR />ProcessId=3040<BR />StartName=LocalSystem<BR />State=Running<BR />Status=OK<BR /><STRONG>SystemName</STRONG>=Server2<BR />wmi_type=ClusterService<BR /><BR />What i am trying to do is just show where Server=Server1 is active, then show <EM>just</EM> the status of the Windows Server from SystemName=Server1. I've tried with "eval Server=coalesce(SystemName,Server)", evals on match (Server==SystemName) as well "where Server=SystemName", but I have been unable to find a way to just show the active server based on the first event, and match the server name based on the second event with the status of the Windows Service.</P><P>Example attached of what the data looks like without attempting to join the values.<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Razziq_0-1616715820198.png" style="width: 785px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/13501i7C664780CB384A18/image-dimensions/785x199?v=v2" width="785" height="199" role="button" title="Razziq_0-1616715820198.png" alt="Razziq_0-1616715820198.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P> Thu, 25 Mar 2021 23:43:54 GMT https://community.splunk.com/t5/Splunk-Search/Matching-Results-of-a-Search-on-One-Value-Based-on-the-Results/m-p/545498#M154522 Razziq 2021-03-25T23:43:54Z https://community.splunk.com/t5/Splunk-Search/Matching-Results-of-a-Search-on-One-Value-Based-on-the-Results/m-p/545508#M154527 <P>Add this to the end of the query</P><LI-CODE lang="markup">| filldown ActiveHost | where ActiveHost=SystemName</LI-CODE> Fri, 26 Mar 2021 00:35:05 GMT https://community.splunk.com/t5/Splunk-Search/Matching-Results-of-a-Search-on-One-Value-Based-on-the-Results/m-p/545508#M154527 bowesmana 2021-03-26T00:35:05Z https://community.splunk.com/t5/Splunk-Search/Matching-Results-of-a-Search-on-One-Value-Based-on-the-Results/m-p/545509#M154528 <P>This worked perfectly! Thank you very much, bowesmana!</P> Fri, 26 Mar 2021 01:13:41 GMT https://community.splunk.com/t5/Splunk-Search/Matching-Results-of-a-Search-on-One-Value-Based-on-the-Results/m-p/545509#M154528 Razziq 2021-03-26T01:13:41Z