Cancel Alert with Different Alert

[Becherer]

I am looking to create a dashboard panel that is synced with our AV tool. The tool that we use is sending events to splunk when the AV protection is disabled and re-enabled. I dont know how to display only the devices that have not had AV re-enabled.

i.e.

PC 1000 is disabled
PC 1000 is enabled
PC 2003 is disabled

The dashboard panel would show one device that needs enabled. Until an event related to PC 2003 is sent that show "PC 2003 is enabled" then the dashboard will show one device needing attention.

How do set "disabled" as + "1" and enabled as - "1"? Unless there is a better way..

Thanks!

[richgalloway]

Assuming each event has a 'server' field ("PC 1000", for example) and a 'status' field ("disabled" or "enabled") then one just needs to look at the most recent status for each server and ignore those that are enabled. Something like this will show the devices needing attention:

index = foo | stats latest(status) as status by server | where status = "disabled"