topic Re: display pool down on two cluster server in Splunk Search

How to display pool down on two cluster server?

elmadi_fares — Fri, 08 Jul 2022 14:32:43 GMT

index=idx_rdap source="*f5*" "*member*" "RO1B4-0JLSM4000S" "/Common/pool_d2i_*gkrgkl" | rex field=member "\/Common\/(?<server>[^:]*)" | stats latest(status) as Last_status, values(pool), as pool_name, values(_time) as _time by pool, server | stats values(Last_status) as Last_status, values(server) as server by pool | eval severity=case(server="XC001X02" AND server="XC001X03" AND Last_status="down", "1", server="XC001X03" AND Last_status="down", "3", server="XC001X02" AND Last_status="down", "3",true(),"0" ) | table pool, Last_status, severity, server | eval hour_of_the_starttime=strftime(_time, "%H") | eval support_group=if(hour_of_the_starttime>=19 OR hour_of_the_starttime<7,"WW-XX-TFORMEGI-L3", "WW-XX-MSEGI-L2") | eval ressource="GKR-GkL-I:" + pool | eval service_offring="GKR-GkL-I" | eval description="VIP GMS got a service status down \n \nDetail : One or more legs Impacted service on :" + pool + "\n On server(s): " + tostring(server) + " \n\n\n\n; " + support_group + " ;KB=KB00000" | table ressource description pool service_offring severity server support_group

Re: I have this search that triggers the pools that are down on the two cluster servers XC001X02 and XC001X03 so if a po

richgalloway — Thu, 07 Jul 2022 12:33:51 GMT

Please edit your post to put the question in the body rather than the subject. As it is now, the question is truncated so we don't know what the problem is.

Re: display pool down on two cluster server

elmadi_fares — Fri, 08 Jul 2022 09:40:30 GMT

I need to have a condition to assign a snow incident to two different groups according to the time slot in working and non-working hours

Re: How to display pool down on two cluster server?

elmadi_fares — Mon, 11 Jul 2022 12:36:32 GMT

someone can you help me ???